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AO 106 (Rev. 06/09) Application for a Search Warrant 


United States District Court 

for the 

Southern District of New York 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

A Device Containing the Results of Three Email 
Search Warrants, See Attachment A 



APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

^i^fi^fce-tEfoffialnfn^ -. 


located in the _ Southern _ District of New York _, there is now concealed (identify the 

person or describe the property to be seized)'. 

PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. 


The basis for the search underFed. R. Crim. P. 41(c) is (check one or more): 

^ evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

□ property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 

Code Section Offense Description 

18 USC 371, 1005, 1014, Conspiracy to defraud the United States; false bank entries; false statements to a 

1343, 1344 financial Institution; wire fraud; bank fraud 



The application is based on these facts: 

PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. 


[?f Continued on the attached sheet. 

Delayed notice of 30 days (give exact ending date if more than 30 days: _ 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Sworn to before me and signed in my presence. 


Date 


City and state: iv y 



Hon. G abriel W. Gor enstein , U.S. Magistrate Judge 

Printed name and title 
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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 




In the Matter of the Application of the United 
States Of America for a Search Warrant for A 
Device Containing the Results of Three Email 
Search Warrants, USAO Reference No 
2018R00127 


Agent Affidavit in Support of 
Application for a Search Warrant 


TO BE FILED UNDER SEAL 


SOUTHERN DISTRICT OF NEW YORK) ss.: 


Special Agent 



of the United States Attorney’s Office for the Southern 


District of New York, being duly sworn, deposes and says: 


I. Introduction 


A. Affiant 


1. I am a Special Agent with the United States Attorney’s Office for the Southern 
District of New York (the “USAO”). I have been a Special Agent with the USAO since August 
2016. I previously served as a Special Agent with the United States Department of Labor Inspector 
General from May 2011 to August 2016. In the course of my experience and training in these 
positions, I have participated in criminal investigations into federal offenses involving a wide array 
of financial crimes, including frauds on financial institutions. I also have training and experience 
executing search warrants, including those authorizing the search of email accounts. 

2. I make this Affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to search the electronic device specified below (the 
“Subject Device”) for the items and information described in Attachment A. This affidavit is based 
upon my personal knowledge; my review of documents and other evidence; my conversations with 
other law enforcement personnel; and my training, experience and advice received concerning the 
use of computers in criminal activity and the forensic analysis of electronically stored information 
(“ESI”). Because this affidavit is being submitted for the limited purpose of establishing probable 
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cause, it does not include all the facts that I have learned during the course of my investigation. 
Where the contents of documents and the actions, statements, and conversations of others are 
reported herein, they are reported in substance and in part, except where otherwise indicated. 

B. Prior Warrants and the Subject Device 

3. As set forth in detail below, the US AO and the Federal Bureau of Investigation 
(“FBI”) are investigating, among other things, a scheme by Michael Cohen to defraud multiple 
banks. Cohen is an attorney who currently holds himself out as the personal attorney for President 
Donald Trump, and who previously served for over a decade as an executive in the Trump 
Organization, an international conglomerate with real estate and other holdings. 

4. In connection with an investigation then being conducted by the Office of the 
Special Counsel (“SCO”), the FBI sought and obtained from the Honorable Beryl A. Howell, Chief 
United States District Judge for the District of Columbia, three search warrants (collectively, the 
“SCO Warrants”) for emails and other content information associated with two email accounts 
used by Cohen. Specifically: 


On or about July 18,2017, the FBI sought and obtained a search warrant for 


a. 



emails in the account 


fegmail.com (the “Cohen Gmail Account”) sent or received 


between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17-mj-00503, is 
attached as Exhibit A (the “First Cohen Gmail Warrant”). 


b. On or about November 13, 2017, the FBI sought and obtained a search 


warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and 


November 13,2017. This warrant, which is numbered 17-mj-00855, is attached as Exhibit B (the 
“Second Cohen Gmail Warrant”). 


c. 


On or about November 13, 2017, the FBI sought and obtained a search 


warrant for emails in the account 



|the “Cohen MDCPC Account”) sent or 
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received between the opening of the Cohen MDCPC Account 1 and November 13, 2017. This 
warrant, which is numbered 17-mj-00854, is attached as Exhibit C (the “Cohen MDCPC 
Warrant”). 

5. The SCO has since referred certain aspects of its investigation into Cohen to the 
USAO, which is working with the FBI’s New York Field Office. As part of that referral, on or 
about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other 
content information obtained pursuant to the SCO Warrants. A filter team working with the SCO 
had previously reviewed the e-mails produced pursuant to the SCO Warrants for privilege. 

6. These emails are contained on the Subject Device, which is particularly described 
as a black and red USB drive with a white label that says “Tracking #: 180208140208.” That is, 
the Subject Device contains the emails and other content information obtained pursuant to the SCO 
Warrants, less any emails that were screened and removed by the SCO’s privilege team. 

7. The Subject Device is presently located in the Southern District of New York. 

C. The Subject Offenses 

8. The affidavits in support of the SCO Warrants describe evidence of several 
different courses of conduct by Cohen, including, among other things, false statements to financial 
institutions relating to the purpose of an account he opened in the name of Essential Consultants 
LLC and the nature of funds flowing into that account, and activities undertaken by Cohen on 
behalf of certain foreign persons or foreign entities without having registered as a foreign agent. 
The SCO Warrants accordingly define the evidence to be seized by reference to subject offenses 

1 Based on my review of this warrant and the affidavit in support of it, I know that the warrant did 
not specify a time period, but the affidavit indicated that, pursuant to court order, the service 
provider had provided non-content information for the Cohen MDCPC Account that indicated that 
the account contained emails from the approximate period of March 2017 through the date of the 
warrant. 
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and specific categories of information related to these courses of conduct. The subject offenses in 


the SCO Warrants are summarized as follows: 


Exhibit 

Warrant 

Subject Offenses in Prior Warrant 

A 

First Cohen Gmail 
Warrant 

18 U.S.C. §§ 1014 (false statement to financial institution), 1956 (money 
laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 
§§611 etseq. (Foreign Agents Registration Act (“FARA”)) 

B 

Second Cohen Gmail 
Warrant 

18 U.S.C. §§ 1014 (false statement to financial institution), 1343 (wire 
fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an 
unregistered foreign agent), and22 U.S.C. §§611 etseq . (FARA) 

c 

Cohen MDCPC Warrant 

18 U.S.C. §§ 1014 (false statement to financial institution), 1343 (wire 
fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an 
unregistered foreign agent), and 22 U.S.C. §§611 etseq. (FARA) 


9. Based on my participation in this investigation, including my review of documents 
obtained pursuant to subpoena and court order, my conversations with witnesses and review of 
reports of conversations with witnesses, and my review of publicly available information, i have 
learned of additional conduct by Cohen, described below, which was not described in the affidavit 
seeking the First Cohen Gmail Warrant and was described briefly in the affidavits seeking the 
Second Cohen Gmail Warrant and the Cohen MDCPC Warrant. 2 

10. I am therefore requesting authority to expand the search of the non-privileged e- 
mails obtained pursuant to the SCO Warrants, as contained on the Subject Device, for evidence 
related to this additional conduct. As set forth below, in addition to the categories of evidence 
already described in the SCO Warrants, there is probable cause to believe that the Subject Device 
contains evidence of violations ofl8U.S.C. §371 (conspiracy to defraud the United States), 1005 
(false bank entries), 1014 (false statements to a financial institution), 1343 (wire fraud), and 1344 
(bank fraud) (collectively, the “Subject Offenses”), related to the additional conduct described 
below. 3 


2 I do not base this application on my review of emails obtained pursuant to the SCO Warrants. 

3 The SCO Warrants cite many of the same statutes as subject offenses and describe categories of 
information that likely encompass evidence of the additional conduct described herein. 
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II. Probable Cause Regarding the Subject Offenses 

11. Together with this application, I am submitting an application for a search 
warrant, pursuant to 18 U.S.C. § 2703, for all content and other information associated with (a) 
the Cohen Gmail Account, for the time period November 14, 2017 to the present; (b) the Cohen 
MDCPC Account, for the time period November 14, 2017 to the present; and (c) three other 
email accounts. The affidavit in support of this application is attached as Exhibit D (the 
“Accompanying Affidavit”), and is incorporated by reference as if fully set forth herein. 

12. As set forth in the Accompanying Affidavit, there is probable cause to believe that 

Cohen has made affirmative misrepresentations in and omitted material information from financial 
statements and other disclosures that Cohen provided to multiple banks in connection with a 
transaction intended to relieve Cohen of approximately $22 million in debt he owed on taxi 
medallion loans from the banks. As set forth in detail in the Accompanying Affidavit, in these 
financial statements, and in his oral and other written statements to these banks, Cohen appears to 
have (i) intentionally omitted cash assets that he began receiving in 2017 from new consulting 
work; (ii) significantly understated his total holdings of cash and cash equivalents; and (iii) failed 
to inf orm the banks from which he was seeking debt relief that he had agreed to make a $3.8 
million cash payment to a third party, , in connection with 

acquisition of the taxi medallions securing Cohen’s debt. By making these misrepresentations and 
material omissions, Cohen avoided making monthly payments on his loans, and attempted to and 
has secured proposed agreements from the banks to relieve him of certain repayment obligations 
worth millions of dollars. 


Nevertheless, in an abundance of caution, I am seeking explicit authorization to search the Subject 
Device for evidence of this additional conduct. 
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13. As noted above, the Accompanying Affidavit seeks email content for the Cohen 
Gmail Account and the Cohen MDCPC Account for the period from November 14, 2017 to the 
present, and therefore establishes probable cause that a search of the email content from that time 
period will reveal evidence, fruits, and instrumentalities of the Subject Offenses. As set forth 
below, the Accompanying Affidavit also establishes probable cause to believe that a search of 
the Subject Device (i. e ., the non-privileged emails from the earlier time periods covered by the 
SCO Warrants) will similarly reveal evidence, fruits, and instrumentalities of the Subject 
Offenses. 4 For example, as described in the Accompanying Affidavit: 

a. In or about December 2014, Sterling National Bank (“Sterling”) agreed to 
lend approximately $22 million to Cohen’s medallion companies. See Accompanying Affidavit 
114(c). 


b. In or about September 2015, Cohen began pushing Sterling for a reduction 
in his monthly payments. See id. $ 14(e). 

c. In or about October 2016, Cohen told a Sterling employee (“Sterling 

3, who 


Employee-1”) that he had a potential buyer of his taxi medallions, named 
would agree to assume Cohen’s debt with Sterling (and Melrose Credit Union, the participating 
bank). See id. $ 14(g). Negotiations of the potential taxi medallion transaction then followed for 
more than a year. See id. $$ 14(g)-(q). 


| 


4 As noted, the Subject Device contains email content for the Cohen Gmail Account from the 
period of June 1, 2015 to November 13,2017, and email content for the Cohen MDCPC Account 
for the period of March 2017 to November 13, 2017. 
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d. On or about February 22, 2017, the Cohen Gmail Account 5 sent an email to 
a Sterling employee (“Sterling Employee-2”) stating that he “agreed to pay down 1 million from 
the loan amount.” See id. If 14(g). 

e. On or about June 8,2017, Cohen emailed Sterling Employee-1 from the 
Cohen Gmail Account, attaching a Sterling personal financial statement form that had been filled 
out by hand, which referenced a statement of financial condition, dated May 1,2017 (the “May 
2017 Financial Statement”), that was also attached. See id. 14(i). 

f. On or about October 5,2017, Cohen, using the Cohen Gmail Account, re¬ 
sent Sterling Employee-2 a copy of his May 2017 Financial Statement. A day later, on October 6, 
2017, Cohen, using the Cohen Gmail Account, emailed Sterling Employee-2 a statement of 
financial condition, dated September 30,2017 (the “September 2017 Financial Statement”). See 
id. Tf 14(m). The September 2017 F ina ncial Statement omitted assets that Cohen held in certain 
bank accounts and substantially understated his available cash and cash equivalents. See id. 
19-20. 

g. It appears that Cohen set up the Cohen MDCPC Account to receive emails 
he was previously receiving at the Cohen Gmail Account. On or about May 5,2017, Cohen sent 
an email from the Cohen MDCPC Account to a blind copy list of recipients, stating that “[d]ue to 
the overwhelming volume of phone calls and emails coming into my previous cellular number 
and e-mail address, I have elected to create for Clients Only the following. Kindly use this new 


5 As noted in n.2, supra , I do not base this application on my review of emails obtained pursuant 
to the SCO Warrants. Where the content of emails sent from or received by the Cohen Gmail 
Account and/or the Cohen MDPC Account are described herein, my description is based on copies 
of these emails produced by third parties pursuant to subpoena or otherwise. 
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information for all future contact and communications.” The signature line on the email listed 
the Cohen MDCPC Account as the new email address. See id. 26. 

h. Based on my review of header information obtained by court order, I have 
learned that, on approximately eight occasions in August and September 2017, while Cohen, 

, and were communicating about a term sheet for the 

Cohen- taxi medallion transaction, the Cohen MDCPC Account sent or received 

emails from ' , including emails on which Sterling employees were copied. On or about 

August 22, 2017, Cohen also used the Cohen MDCPC Account to send an email to Sterling 
Employee-1. See id. K 27(a). 

i. Based on my review of header information obtained by court order, I have 

learned that on or about September 1, 2017—at or around the time the and Cohen 

were negotiating a term sheet-—the Cohen MDCPC Account sent or received eight emails to or 
from: . See id. 25(b). 

14. Therefore, there is probable cause to believe that a search of the Subject Device 
will reveal evidence, fruit and instrumentalities of the Subject Offenses, including the following: 

a. Communications, records, documents, and other files involving Sterling, 
Melrose, and/or taxi medallions; 

b. Communications, records, documents, and other files involving a plan, 

proposal, or agreement for Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to others, including to ~J| and/or 

entities associated with him; 

c. Communications, records, documents, and other files necessary to establish 
the identity of any person(s) - including records that reveal the whereabouts of the person(s) - 
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who communicated with the Cohen Gmail Account and/or the Cohen MDCPC Account about any 
plan or proposal or agreement for Cohen and/or entities associated with him to transfer any interest 
in taxi medallions, and any associated debts or liabilities, to others, including to 
and/or entities associated with him; 

d. Communications between the Cohen Gmail Account and/or the Cohen 
MDCPC Account and Jeffrey Getzel relating to Cohen’s bank accounts, taxes, debts, and/or 
finances; 

e. Evidence indicating the Cohen Gmail Account and the Cohen MDCPC 
Account owner’s intent as it relates to the Subject Offenses under investigation. 

III. Procedures for Searching ESI 
A. Review of ESI 

15. Law enforcement personnel (including, in addition to law enforcement officers and 
agents, and depending on the nature of the ESI and the status of the investigation and related 
proceedings, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, interpreters, and outside vendors or technical experts under 
government control) will review the ESI contained on the Subject Device for information 
responsive to the warrant. 

16. In conducting this review, law enforcement personnel may use various methods to 
locate evidence, fruits, and instrumentalities of the Subject Offenses, including but not limited to 
undertaking a cursory inspection of all emails contained on the Subject Device. This method is 
analogous to cursorily inspecting all the files in a file cabinet in an office to determine which paper 
evidence is subject to seizure. Although law enforcement personnel may use other methods as 
well, particularly including keyword searches, I know that keyword searches and similar methods 
are typically inadequate to detect all information subject to seizure. As an initial matter, keyword 
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searches work only for text data, yet many types of files commonly associated with emails, 
including attachments such as scanned documents, pictures, and videos, do not store data as 
searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture 
all relevant communications in an account, as it is impossible to know in advance all of the unique 
words or phrases that investigative subjects will use in their communications, and consequently 
there are often many communications in an account that are relevant to an investigation but that 
do not contain any keywords that an agent is likely to search for. 

IV. Conclusion and Ancillary Provisions 

17. Based on the foregoing, I respectfully request the court to issue a warrant to seize 
the items and information specified in Attachment A to this affidavit and to the Search and Seizure 
Warrant. 

18. In light of the confidential nature of the continuing investigation, and for the 
reasons more fully set forth in the Accompanying Affidavit, I respectfully request that this affidavit 
and all papers submitted herewith be maintained under seal until the Court orders otherwise. 



Special Agent, US AO 



4 \ * ,f '' / | 

Sworn to before me on i / r ].- > 
28th day of Febiuary, 2018 . 


i \ \ 


li 
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Attachment A 

I. Device to be Searched 

The device to be searched (the “Subject Device”) is described as a black and red USB drive 
with a white label that says “Tracking #: 180208140208”, which contains emails and other content 
information obtained pursuant to the three search warrants, numbered 17~mj-00503, 17-mj-00855 
and 17-mj-00854, obtained by the Special Counsel’s Office (“SCO”), less the emails that were 
screened and removed by the SCO’s privilege team. 

II. Review of ESI on the Subject Devices 

Law enforcement personnel (including, in addition to law enforcement officers and agents, 
and depending on the nature ol the ESl-and the status of-the inves tigation and related proceedings, 
attorneys for the government, attorney support staff, agency personnel assisting the government in 
this investigation, interpreters, and outside vendors or technical experts under government control) 
are authorized to review the ESI contained on the Subject Device for evidence, fruits, and 
instrumentalities of one or more violations ofl8U.S.C. §371 (conspiracy to defraud the United 
States), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (wire 
fraud), and 1344 (bank fraud) (collectively, the “Subject Offenses”), as listed below: 

a. Communications, records, documents, and other files involving Sterling National 
Bank, Melrose Credit Union, and/or taxi medallions; 

b. Communications, records, documents, and other files involving a plan, proposal, or 


agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to others, including to and/or 

entities associated with him; 

c. The identity of any person(s) - including records that reveal the whereabouts of the 

person(s) — who co mm unicated with gmail.com and/or 

“Subject Accounts”) about any plan or proposal or agreement for Michael D. Cohen and/or entities 



associated with him to transfer any interest in taxi medallions, and any associated debts or 


liabilities, to others, including to 


and/or entities associated with him; 


d. Communications between the Subject Accounts and Jeffrey Getzel relating to 


Michael D. Cohen’s bank accounts, taxes, debts, and/or finances; 
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e. 


Evidence indicating the owner of the Subject Accounts’ intent as it relates to the 


Subject Offenses under investigation. 
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Exhibit A 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 


file 


JML 24 rn 


In the Matter of the Search of ) 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) 

INFORMATION ARSOOIATFn WITH THE EMAIL ) 

ACCOUNT @GMAIL.COM ) 


) 


,-asei 1;17~nni 00503 
.ssigned To : Howell, Beryl A. 
lS sian Date '.7/18/2017 

Rftl7.Ll 


SEARCH AND SEIZURE WARRANT 


Tot Any authorized law enforcement officer. ' ~ . 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ Northern District of _ California 

(identify the person or describe the property to be searched and give its location)l 


■ 



See Attachment A. 


I find that the affidavits)* or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 

See Attachment B, 


YOU ARE COMMANDED to execute this warrant on or before _ Augu st 1 , 201 7 _ (not to exceed 14 days) 

$ in the daytime 6;00 a.m, to 10:00 p.m. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventoiy to __ Hon, Beryl A. Howell _ . 

(United States Magistrate Judge) 

O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C* 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for_days (not to exceed SO) □ until, the facts justifying, the later specific date of __ _ . 


Date and time issued; 






Judge’s signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 
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AO 93 (Rev 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

-yjib/'^on WA&m 

Copy of warrant and inventory left with; 

17-A« \ +0&S&& 

G-oo^Cl_ rSi®'-? 

Inventory made in the presence of: 

. C' u ' !tr 


Inventory of the property taken and name of any person(s) seized: 


DrjiM /its- I isffoff 

11 S'o&ey - ^oiyoyiq- j 

l,r/ 


FILED 

JUL 21 2017 

Clerk u.S. District and 
Bankruptcy Courts 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 

Dale; 7/4?/4^>/7 


J 
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| 

■ ATTACHMENT A 

This warrant applies to information associated with the Google Mail Account 
@gmail.com that is stored at premises owned, maintained, controlled, or operated by 
Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 


1 
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ATTACHMENT B 


I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Google (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including any 
emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
aecounfeorfidentifier-listed-imAttachmentrAt _ —-_------- _ 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
•session times and dates, account status, alternative e-mail addresses provided 
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during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 

f. All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 

i. All cookies, including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 

k. All telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

II. Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial 
institution) and 18 U.S.C. § 1956 (money laundering), as well as 18 U.S.C. § 951 (acting as an 
unregistered foreign agent) and the Foreign Agents Registration Act (“FARA”), 22 U.S.C. § 611 
et seq., involving Michael Dean Cohen and occurring on or after January 1, 2016, including, for 
each account or identifier listed on Attachment A, information pertaining to the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files involving Bo and Abe Realty, 
LLC; 

c. Communications, records, documents, and other files that false representations to a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 
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account a financial institution; the source of funds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 

d. Records of any funds or benefits received by or offered to Michael Dean Cohen by, 
or on behalf of, any foreign government, foreign officials, foreign entities, foreign 
persons, or foreign principals; 

e. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 

:r=r— prj-j^jpaJgj ‘ 1 ----- 

f. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

g. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

h. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); and 

h The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

WITH THE EMAIL 
gGMAIL.COM 


SEARCH AND SEIZURE WARRANT 

ToC ~AlnyTuthor ized law^nforc^enFSHic^.~~ ~~ ~ . : 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 

(identify the person or describe the property to be searched and give its location)', 


'INFORMATIOflASgQCl^EEEl 

ACCOUNT 


) 

) Case: 1:17-mj-00855 

\ Assigned To : Chief Judge Howell, Beryl A. 
' Assign. Date : 11/13/2017 

i Description: Search and Seizure Warrant 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)'. 


See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before November 2'0, 2017 (not to exceed 14 days) 
ill the daytime 6;G0 a.m. to 10:00 pan. □ at any time in the day or night because good cause has been established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken, 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and Inventory to __ Hon. Beryl A. Howell _* 

(United States Magistrate Judge) 

□ Pursuant to 18 U.SU. § 3103 a(b), I find that immediate notification may have an adverse result listed in 18 U.S.G. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for_days (not to exceed 30 ) □ until, the facts justifying, the later specific date of __. 

Judge's signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 

Printed name and title 


Date and time 


issued: ////d/ <3 (T 


City, and state: 


Washington, DC 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 



Return 


Case No.: 

Date and time warrant executed: 

Copy of warrant and inventory left with: 

Inventory made in the presence of: 



Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Date: _ _ 

Executing officer's signature 


Printed name and 'title 
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ATTACHMENT A 

This warrant applies to information associated with the Google Mail Account 
@gmail.com that is stored at premises owned, maintained, controlled, or operated 
by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 


1 
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ATTACHMENT B 

I. Information to be disclosed by Google 

To the extent that the information described in Attachment A is within the possession, 
custody, of control of the Google (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including any 
emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, the Provider is required to disclose the following information to the government for each 
account or identifier listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source arid 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers., records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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f. All search history or web history; 

g. All records indicating the services available to subscribers of the accounts; 

h. All usernames associated with or sharing a.login IP address or browser cookie with 
the accounts; 

L All cookies* including third-party cookies, associated with the user; 

j. All records that are associated with the machine cookies associated with the user; 
and 

k. All telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

IL Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C, § 1014 (false statements to a financial 
institution), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1344 (bank fraud), and 18 U.S.C. § 1956 
(money laundering), as well as 18 U.S.C. § 951 (acting as an unregistered foreign agent) and the 
Foreign Agents Registration Act (“FARA”), 22 U.S.C. § 611 et seq., involving Michael Dean 
Cohen and occurring on or after June 1, 2015, including, for each account or identifier listed on 
Attachment A, information pertaining to the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files that false representations to a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 
account a financial institution; the source of funds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 
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c. Records of any funds or benefits received by or offered to Michael Dean Cohen by, 
or on behalf of, any Foreign government, foreign officials, foreign entities, foreign 
persons, or foreign principals; 

d. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

e. Evidence indicating how and when the account was accessed or used, to determine 

ggographic“andehronblbgiMl"contexfbfaccbunf accessfuse, andeventsrelatihg 

to the crimes under investigation and to the account owner; 

f. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

g. The identity of tire person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); and 

h. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of; for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements Concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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AG 93 (Rev. 11/13) Search and Seizure Warrant 


United States District Court 

for the 

District of Columbia 

) 

) Case: 1:17-mj-00854 
) Assigned To : Chief Judge Howell, Beryl A. 
) Assign. Date : 11/13/2017 
) Description: Search and Seizure Warrant 


SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 

of the following person or property located in the _ Northern _ District of _ California 

(identify the person or describe the property to be searched and give its location)l 

See Attachment A. 


tn the Matter of the Search of 

(Briefly describe the property to be.searched 
Or identify the person by name and address) 

IW^RM^rTO^SSnulATED WITH THE ACCOUNT 

WHICH IS STORED AT THE 
PREMISES OF T&1 INTERNET, INC. 


I find that the affi davit (s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized)\ 

See Attachment Eh 


YOU ARE COMMANDED to execute this warrant on or before November 20, 2Q17 ( no \ to exceed 14 days) 
$ in the daytime 6:Q0 a.m. to 10:00 p.m. D at any time in the day or night because good cause has been established 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
a$ required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell ___, 

(United State's Magistrate Judge) 

□ Pursuant to 18 U.S.G. § 3103a(b), 1 find that immediate notification may have an adverse result listed in 18 U.S.C. 

§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

til for_ days (not to exceed 30) □ until, the facts justifying, the later specific date of _ , 


Date and time issued: 


City and state: 



Judge *s signature 

Hon. Beryl A: Howell, Chief U.S, District Judge 
Printed name and title 
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AO 93 (Rev. i 1/13) Search and Seizure Warrant (Page2) 
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ATTACHMENT A 

This warrant applies to information associated with the entail | | that 

is stored at premises owned, maintained, controlled, or operated by l&l Internet, Inc. (“l&l”), an 
electronic communication and/or remote computing service provider headquartered in Sunnyvale, 
California. 


1 
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ATTACHMENT B 

I, Information to be disclosed by l&l 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the l&l (hereinafter “the Provider”), regardless of whether Such information 
is stored, held or maintained inside or outside of the United States, and including any emails, 
records, files, logs, or information that have been deleted but are still available to the Provider, the 
Provider is required to disclose the following information to the government for each account or 
identifier listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account,, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. AH records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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All search history or web history; 

All records indicating the services available to subscribers of the accounts; 

All usernames associated with or sharing a iogin IP address or browser cookie with 
the accounts; 

All cookies, including third-party cookies, associated with the user; 

All records that are associated with tire machine cookies associated with the user; 
and 

All telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 

II, Information to be Seized by the Government 

All information described above in Section I that constitutes evidence, contraband, fruits, 
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial 
institution),.! 8 U.S.C. § 1343 (wire fraud), 18 U.S.C, § 1344 (bank fraud), and 18 U.S.C. § 1956 
(money laundering), as well as 18 U.S.C. § 951 (acting as an unregistered foreign agent) and the 
Foreign. Agents Registration Act ("FARA”), 22 U.S.C, § 611 et seq., involving Michael Dean 
Cohen, including, for each account or identifier listed on Attachment A, information pertaining to 
the following matters: 

a. Communications, records, documents, and other files involving Essential 
Consultants, LLC; 

b. Communications, records, documents, and other files that false representations to a 
financial institution with relation to intended the purpose of an account or loan at 
that financial institution; the nature of any business or entity associated with an 
account a financial institution; the source of funds flowing into an account; or the 
purpose or nature of any financial transactions involving that financial institution; 


f. 

g- 

h. 

i. 

j- 

k. 
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c. Records of any funds or benefits received by or offered to Michael Dean Cohen by, 
or on behalf of, any foreign government, foreign officials, foreign entities, foreign 
persons, or foreign principals; 

d. Communications, records, documents, and other files that reveal efforts by Michael 
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction 
of any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

e. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chrono logical context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

f. Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

g. • The identity of the person(s) who created or used the account, including records 

that help reveal the whereabouts of such person(s); and 

h. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or 
at the direction of any foreign government, foreign officials, foreign entities, 
foreign persons, or foreign principals. 

III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of a Warrant for All 
Content and Other Information 
^^^^^^^ith the Email Accounts 
gigmail.com, 

TO BE FILED UNDER SEAL 

AGENT AFFIDAVIT 

Maintained at 

Premises Controlled by Google, Inc., 
the Email Account 

Maintained at Premises Controlled by 
Oath, Inc., and the-Email Account 

maintained at 


Premises Controlled by 1 & 1 Internet, 


Inc., USAO Reference No. 


2018R00127 



Agent Affidavit in Support of Application for a Search Warrant 
for Stored Electronic Communications 


STATE OF NEW YORK ) 

) ss. 

COUNTY OF NEW YORK ) 

Special Agent j pif the United States Attorney’s Office for the Southern 

District of New York, being duly sworn, deposes and states: 

I. Introduction 
A. Affiant 

1. I am a Special Agent with the United States Attorney’s Office for the Southern District 
of New York (the “USAO”). I have been a Special Agent with the US AO since August 2016. I 
previously served as a Special Agent with the United States Department of Labor Inspector 
General from May 2011 to August 2016. In the course of my experience and training in these 
positions, I have participated in criminal investigations into federal offenses involving a wide array 
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of financial crimes, including frauds on financial institutions. I also have training and experience 
executing search warrants, including those authorizing the search of email accounts. 

B. The Provider, the Subject Account and the Subject Offenses 

2. I make this affidavit in support of an application for a search warrant pursuant to 18 
U.S.C. § 2703 for all content and other information associated with the email accounts 
l@gmail.com (the “Cohen Account”), (the “MDCPC 

Account”) v ^^^B@g mail.com (the I Accou nt”). (the 


Account”), and 


“Subject Accounts”). The Cohen Account, 



Account”) (collectively, the 
Account, anc 


Account are maintained and controlled by Google, Inc., headquartered at 1600 Amphitheatre 
Parkway, Mountain View, California 94043 (“Google”), the MDCPC Account is maintained and 
controlled by 1 & 1 Internet, Inc., headquartered at 701 Lee Road, Suite 300, Chesterbrook, 
Pennsylvania 19087 (“1 & 1”), and the Account is maintained and controlled by Oath, Inc., 
22000 AOL Way, Dulles, Virginia 20166 (“Oath”) (together, the “Providers”). The information 
to be searched is described in the following paragraphs and in Attachments A, B, C and D to the 
proposed warrants. 

3. As detailed below, there is probable cause to believe that the Subject Accounts contain 
evidence, fruits, and i ns trumentalities of violations of 18 U.S.C. § 371 (conspiracy to defraud the 
United States), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 
(wire fraud), and 1344 (bank fraud) (collectively, the “Subject Offenses”). The Target Subjects of 
this investigation are MICHAEL COHEN (“Cohen”) and others known and unknown. This 
affidavit is based upon my personal knowledge, my review of documents produced pursuant to 
grand jury subpoenas and prior search warrants, my review of interview reports prepared by other 
law enforcement officers, and my conversations with other law enforcement officers, as well as 


02 . 28.2018 
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my training and experience concerning the use of email in criminal activity. Because this affidavit 
is being submitted for the limited purpose of establishing probable cause, it does not include all 
the facts I have learned during my investigation. Where the contents of documents and the actions, 
statements, and conversations of others are reported herein, they are reported in substance and in 
part, except where otherwise indicated. 

C. Services and Records of the Provider 

4. I have learned the following about the Providers: 

a. The Providers offer email services to the public. In particular, Google permits 

subscribers to maintain email accounts under the domain name gmail.com. Google also allows a 
subscriber to maintain email accounts under any domain name under the subscriber’s control. For 
example, if a subscriber controls the domain name Google enables the subscriber 

to host any email address under this domain name on servers operated by Google. Oath permits 
subscribers to maintain email accounts under the domain name aol.com. 1 & 1 permits subscribers 
to maintain email accounts under any domain name under the subscriber’s control. For example, 
if a subscriber controls the domain name ' 1 & 1 enables the subscriber to host any 

email address under this domain name on servers operated by 1 & 1. A subscriber using the 
Providers’ services can access his or her email account from any computer connected to the 
Internet. 

b. The Providers maintain the following records and information with respect to every 
subscriber account: 

i. Email contents. In general, any email (which can include attachments such 
as documents, images, and videos) sent to or from a subscriber’s account, or stored in draft form 
in the account, is maintained on the Providers’ servers unless and until the subscriber deletes the 
email. If the subscriber does not delete the email, it can remain on the Providers’ computers 


02.28.2018 
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indefinitely. Even if the subscriber deletes the email, it may continue to be available on the 
Provider’s servers for a certain period of time. 

ii. Address book. The Providers also allow subscribers to maintain the 
equivalent of an address book, comprising email addresses and other contact information of other 
email users. 

iii. Subscriber and billing information. The Providers collect and maintain 
(typical1 -y-unve i'ified)identifyin gdnfor mation-about.each-Subscriber,-including. for example, name, 
username, address, telephone number, and alternate email addresses. The Providers also maintain 
records concerning the date on which the account was created, the Internet protocol (“IP”) address 
of the user at the time of account creation, the current status of the account (e.g., active or closed), 
the length of service, and the types of services utilized by the subscriber. Additionally, for paying 
subscribers, the Providers maintain records of the subscriber’s means and source of payment, 
including any credit card or bank account number. 

iv. Transactional information. The Providers also typically retain certain 
transactional information about the use of each account on its system. This information can include 
records of login (i.e., session) times and durations and the methods used to connect to the account 
(such as logging into the account through the Providers’ website). 

v. Customer correspondence. The Providers also typically maintain records 
of any customer service contacts with or about the subscriber, including any inquiries or 
complaints concerning the subscriber’s account. 

vi. Search history. Google and Oath also typically maintain records of any 
search history or web history associated with the subscriber’s account. 


02.28.2018 
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vii. Associated content. Google also typically maintains content and records 
relating to the following applications that are associated with its e-mail accounts: (A) “Google 
Docs,” which provides document-editing software that can be used to create, share, store, and 
manage documents online; (B) “Google Drive,” which enables users to store files on Google 
servers, where they can be accessed remotely by the user and others; and (C) “Gchaf ’ or “Instant 
Messenger,” which provides a chat interface through which users can communicate with each 

other, in-real time_Oath also-typically-maintains co n tent and-records relating. to. .AQL -instant 

message, which provides a chat interface through which users can communicate with each other 
in real time. 

viii. Preserved and backup records. The Providers also maintain preserved 
copies of the foregoing categories of records with respect to an account, for at least 90 days, upon 
receiving a preservation request from the Government pursuant to 18 U.S.C. § 2703(f). The 
Providers may also maintain backup copies of the foregoing categories of records pursuant to its 
own data retention policy. 

D. Jurisdiction and Authority to Issue Warrant 

5. Pursuant to 18 U.S.C. §§ 2703(a), (b)(1)(A) & (c)(1)(A), the Government may require 
a provider of an electronic communications service or a remote computing service, such as the 
Providers, to disclose all stored content and all non-content records or other information pertaining 
to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules 
of Criminal Procedure. 

6. A search warrant under § 2703 may be issued by “any district court of the United States 
(including a magistrate judge of such a court)” that “has jurisdiction over the offense being 
investigated.” 18 U.S.C. § 2711(3)(A)(i). 


02 . 28.2018 
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7. When the Government obtains records under § 2703 pursuant to a search warrant, the 
Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 
§ 2703(a), (b)(1)(A), (c)(2) & (3). Additionally, the Government may obtain an order precluding 
the Provider from notifying the subscriber or any other person of the warrant, for such period as 
the Court deems appropriate, where there is reason to believe that such notification will seriously 
jeopardize an investigation. 18 U.S.C. § 2705(b). 

==~Ev=Prior Applications — • — — -- - = = - —- 1 - ■ .—_ 

8. On or about July 18, 2017, in connection with an investigation being conducted by the 
Office of the Special Counsel (“SCO”), the Federal Bureau of Investigation (“FBI”) sought and 
obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District 
of Columbia, a search warrant for emails in the Cohen Account sent or received between January 
1, 2016 and July 18, 2017. On or about November 13, 2017, the FBI sought and obtained from 
Judge Howell search warrants for emails in the Cohen Account sent or received between June 1, 
2015 and November 13, 2017, and emails in the MDCPC Account sent or received between the 
opening of the account and November 13, 2017. The SCO has since referred certain aspects of 
their investigation into Cohen to the USAO, which is working with the FBI’s New York Field 
Office. As part of that referral, the SCO provided the USAO with emails and other content 
information obtained pursuant to the search warrants executed by the SCO, which had already 
been reviewed for privilege. 1 As discussed below, this affidavit is based in part on my review of 


1 In an abundance of caution, in a separate application the USAO has sought authorization, 
pursuant to Fed. R. Crim. P. 41, to review the emails obtained pursuant to the Prior Cohen Account 
Warrants for evidence related to certain additional conduct that was not the focus of the Prior 
Cohen Account Warrants. The emails obtained from the Prior Cohen Account Warrants that relate 
to that additional conduct do not form a basis for the instant application. 
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responsive materials produced pursuant to the July 18 and November 13,2017 warrants (the “Prior 
Cohen Account Warrants”). 

9. On or about November 7,2017, and January 4, 2018, as well as certain prior dates, the 
SCO sought and obtained from Judge Howell orders authorizing and extending the installation and 
use of pen registers and trap and trace devices to record communications sent to or from the Cohen 
Account. The SCO has provided pen register data obtained pursuant to those orders to the USAO. 


This'affidavitfas-disGussed belowpis-based-in part on my^review-ofrthe pen register-data obtained 


pursuant to the November 7, 2017 and January 4, 2018 orders (the ‘Ten Register Data”). 

10. On or about February 16, 2018, the USAO sought and obtained from the Honorable 
Debra Freeman, United States Magistrate Judge for the Southern District of New York, an order 
pursuant to 18 U.S.C. § 2703(d) for email header i nf ormation associated with the MDCPC 
Account. This affidavit, as discussed below, is based in part on my review of email header 
information produced by 1 & 1 in response to that order (the “MDCPC Header Information”). 

II. Probable Cause 
A. Overview 

11. The United States Attorney’s Office for the Southern District of New York and FBI are 
investigating, among other things, a scheme by Target Subject Michael Cohen to defraud multiple 
banks. Cohen is an attorney who currently holds himself out as the personal attorney for President 
Donald Trump, and who previously served for over a decade as an executive in the Trump 
Organization, an international conglomerate with real estate and other holdings. 

12. The investigation has revealed that Cohen has made affirmative misrepresentations in 
and omitted material information from financial statements and other disclosures that Cohen 
provided to multiple banks in connection with a transaction intended to relieve Cohen of 
approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth 
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in detail below, in these financial statements, and in his oral and other written statements to these 
banks, Cohen appears to have (i) intentionally omitted cash assets that he began receiving in 2017 
from new consulting work; (ii) significantly understated his total holdings of cash and cash 
equivalents; and (iii) failed to inform the banks from which he was seeking debt relief that he had 

in connection with 


agreed to make a $3.8 million cash payment to a third party, 

acquisition of the taxi medallions securing Cohen’s debt. By making these 
misrepresentations.-and-material. omissions^Gohen-aveidcd making monthly- payments on his 


loans, and attempted to and had secured proposed agreements from the banks to relieve him of 
certain repayment obligations worth millions of dollars. 

13. Based on my review of emails obtained from the Prior Cohen Account Warrants, 

MDCPC Header Information, and documents produced pursuant to subpoenas, I have learned that 
Cohen has used the Cohen Account and/or MDCPC Account to, among other things, (i) 
communicate with? and their attorney,| 

about the proposed transfer of Cohen’s medallions and associated debts; (ii) negotiate a pay-down 
of the principal amount of the taxi medallion loans; (iii) communicate with his accountant about 
the contents of the false financial statements at issue; and (iv) send those false financial statements 
to Additionally, 

Accouni \ccount and |\.c count, respectively, to communicate with Cohen 

about the status of the taxi medallion transaction, and to send relevant financial statements to 
banks. Accordingly, and as set forth in more detail below, there is probable cause to believe that 
the Subject Accounts will include evidence of the Subject Offenses. 

B. Cohen’s Statements to Sterling National Bank 

14. As set forth in detail below, in 2014, Cohen, through limited liability corporations 
(“LLCs”) controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling 
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National Bank (“Sterling”) and the Melrose Credit Union (“Melrose”), secured by taxi medallions, 
for approximately $20 million. Though entered into by LLCs, the loans were also secured by 
personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry 
weakened and the medallions were devalued, Cohen sought to renegotiate the terms of those loans 
and/or relieve himself from their obligations, including the personal guarantees. As part of that 
effort, Cohen made a series of representations to Sterling and Melrose about his net worth, assets. 


available cash-and financial-o ut lo ok -. — Specifically r ba s ed -on-m-y- rev i ew -of records m a intained b y 


Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi 
medallions, as well as my review of reports prepared by law enforcement officers of interviews 
with a Sterling executive vice-president (the “Sterling Employee-1”) and my participation in an 
interview with a Sterling employee (the “Sterling Employee-2”), I have learned, among other 
things, the following: 

a. Taxi medallions are small metal plaques affixed to taxis. Without a medallion, it 
is illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his 
wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two 
medallions). 2 Cohen’s purchase of these New York taxi medallions was originally financed by 
loans from Capital One Bank, for which the medallions served as collateral. Cohen was not a taxi 
operator, and leased his medallions to a third party. That third party made monthly payments to 
Cohen, who in turn used some of those proceeds to pay his monthly loan payments. 

b. In early 2014, Cohen became a customer of Sterling when he sought to refinance a 
mortgage on a rental property that he owned. In or around April 2014, Cohen raised with Sterling 


2 One of these companies, Mad Dog Cab Corp., was jointly owned by Sondra Cohen, who I 
believe is Cohen’s mother. 
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the prospect of refinancing his taxi medallion loans, which were then at Capital One Bank. By in 
or about September 2014, Cohen began negotiating a lending transaction with Sterling that would 
allow Cohen to pay off his loans at Capital One and borrow more money from the then-increase in 
value of the medallions. According to Sterling Employee-1, in 2014, prior to the recent upheaval 
in the taxi industry—as a result of the emergence of ride-sharing services, such as Uber—taxi 
medallion loans were viewed by banks and investors as safe, short term credits, as the market value 


oftaximedallions was^consistently-risingr-Gonsequentlyvtaximedallionloans—like the loans held 


by Cohen—were frequently refinanced at increasing amounts as the value of the medallions rose. 
According to Sterling Employee-1, borrowers typically cashed out the increase in the loan amount 
and used the additional funds for other purposes. Cohen appears to have followed this approach in 
2014, when he agreed to refinance his medallion loans for approximately $22 million, which— 
according to letters from Capital One Bank in Sterling’s files—was greater than his previous debt 
at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This 
allowed Cohen to cash out the proceeds from the transaction. 

c. Based on my review of records maintained by Sterling, I have learned that on or 
about December 8, 2014, each of Cohen’s sixteen taxi medallion corporations entered into loan 
agreements and promissory notes with Sterling for the principal sum of $ 1,375,000, with repayment 
due on December 8, 2016. Each loan was signed by Michael or Laura Cohen, depending on who 
was the sole shareholder of the corporation. The loans were also each secured by a security 
agreement, dated the same day, maldng the medallions collateral for the notes. To give Sterling 
additional security, Michael and Laura Cohen signed personal guarantees and confessions of 
judgment, giving Sterling the right to pursue collection against the Cohens’ personal assets were 
their corporations to default under the loan agreements. In total, Sterling agreed to lend 
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approximately $22 million to the Cohens’ companies. Pursuant to participation agreements. 
Sterling transferred 45 percent of that debt to Melrose. 3 Under the terms of Sterling’s participation 
agreements with Melrose, Sterling was precluded from amending or modifying the loans without 
the consent of Melrose. 

d. In evaluating Cohen’s requested refinancing of the taxi medallions. Sterling (and 
Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling’s 


request, Cohen provided Sterling with a statement of financial condition, dated August 1, 2014 


(the “August 2014 Financial Statement”), which indicated that Cohen had $100,740,000 in total 
assets, $23,550,000 in total liabilities, and a net worth of $77,190,000. 4 From my review of a 
Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the 
transaction favorably because, accounting for loan payments, cash flows from the medallions were 
projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, 
and the net worth of Cohen—who was the direct obligor under the guarantee agreements—was 
over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 
2014, recommended approval of the loans for substantially the same reasons. 

e. Based on my review of records maintained by Sterling and public sources, I have 
learned that overtime, the collateral backing Cohen’s loans (taxi medallions) lessened in value due 
to the rise in ride-sharing companies and significant devaluation of taxi medallions. Additionally, 
Cohen began falling behind on loan payments to Sterling and Melrose. I know from records 
maintained by Sterling and an interview with Sterling Employee-2 that, beginning in or around 


3 Melrose, which had a business principally focused on taxi medallion loans, is now in 
conservatorship by the National Credit Union Administration (“NCUA”). 

4 Cohen subsequently provided Sterling with a revised statement of financial condition, also 
dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,550,000, and a 
net worth of $75,870,000. 
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September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen’s 
medallions had fallen behind in making payments to Cohen, and that as a result, the monthly cash 
flow from his taxi medallions had been reduced, leaving him with a shortfall of approximately 
$16,000 each month. For instance, I have reviewed an email from Sterling Employee-2, dated 
September 9,2015, summarizing a call with Cohen—which according to the email and toll records 
for Cohen’s cellphone occurred on September 8, 2015—during which Cohen told Sterling 
Emplo ye e-2, in. sum .and subst an ce ,-.ab . ou t-his.xash--flo w problems.and a monthly.- s hortf a lLof. 
approximately $16,000. In that same email, Sterling Employee-2 commented that despite Cohen’s 
statements, his personal financial information “indicate[d] a strong ability to make up the difference 
in payments.” Cohen, however, according to Sterling Employee-2, pushed the bank for a reduction 
in Cohen’s monthly payments. 

f. From my review of records maintained by Sterling and my participation in an 
interview with Sterling Employee-2, I have learned that Cohen and Sterling Employee-2 spoke 
again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the 
individual to whom Cohen leases the medallions had again reduced monthly payments to Cohen. I 
know from my review of records maintained by Sterling that between in or about September 2015 
and November 2015, Sterling raised the possibility—both internally and with Cohen—of Cohen 
posting his real estate holdings, personal residence, or some other collateral as additional security 
for the banks. According to these records, however, Cohen resisted these requests. From my review 
of loan documents and records maintained by Sterling, I know that in or about November 2015, as 
a result of Cohen’s representation that he was not earning sufficient returns on his medallions to 
cover monthly interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, 
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among other things, reducing the interest rate Cohen paid to Melrose and extending the loan 
maturity date to December 8, 2017. 

g. I know from interviews with Sterling Employee-1 and Sterling Employee-2, as well 
as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee-1 that 
Cohen had a potential buyer of his taxi medallions, named who would agree to 

assume Cohen’s debt with Sterling and Melrose. Based on my review of records maintained by 


Sterling; as well as the interviews with Sterling Employee-1 and Sterling Hmploycc-2 referenced 


above, I know that by or before October 2016, Cohen had entered into negotiations to sell his sixteen 
corporate taxi medallions to who is a medallion owner and taxi operator, for the 

balance of the loans, which at the time was $21,376,000. I know from my review of records 
maintained by Sterling, and my participation in an interview with Sterling Employee-2, that as a 
condition of the transfer of the medallion loans—and because Sterling was unfamiliar with 

—Sterling requested that Cohen make a substantial principal payment on the loan, of 
approximately one million dollars, prior to the transfer. Cohen rejected this request initially. But 
on or about January 31,2017, Cohen told Sterling Employee-1, in sum and substance, that he would 
make a one million dollar principal reduction payment in order to move forward with the medallion 
transfer deal with Indeed, in an email sent from the Cohen Account to Sterling 

Employee-2 on or aboutFebruary 22,2017, Cohen confirmed that he “agreed to pay down 1 million 
from the loan amount.” 

h. Pursuant to the participation agreements between Sterling and Melrose, Sterling 
was required to secure Melrose’s agreement to participate in the transfer of the taxi medallion debt 
from Cohen to On or about April 17, 2017, Sterling sent a memorandum to 

Melrose summarizing the terms of the proposed transaction, and noting the requirement that 
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emailed Sterling 


Melrose agree to the terms. On or about May 2, 2017, 



Kccount to inquire about the status of the transaction. 


Employee-1 from the 


i Account that 


Sterling Employee-1 responded t( 



Melrose had agreed to the deal, and that Sterling would be sending 


term sheet 


shortly. 


i. In order for the banks to evaluate the proposed transaction fully, they requested 


financial information from the parties. On or about October 26,2016, a Sterling employee emailed 



Account about the “Cohen Medallion Purchase,” and stated “[i]n order to 


the 


proceed with the assumption of Michael’s loans,” Sterling needed certain financial information 




i responded from the 


ccount, copying 


Account, that he would send a financial statement and tax 


returns shortly. Additionally, on or about June 7, 2017, Sterling Employee-1 emailed Cohen to 


request an “updated personal financial statement,” completed jointly with Cohen’s wife, and 


Cohen’s most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling 
Employee-1 from the Cohen Account, attaching a Sterling personal financial statement form that 
had been filled out by hand, which referenced a statement of financial condition, dated May 1, 
2017 (the “May 2017 Financial Statement”), that was also attached. The May 2017 Financial 
Statement included a cover letter from Cohen’s accountant, Jeffrey Getzel, stating, in sum and 
substance, that the information in the statement came from Cohen and that Getzel had not 
confirmed its accuracy or completeness. The May 2017 Financial Statement stated that Cohen had 
total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The 
May 2017 Financial Statement indicated that Cohen’s assets were comprised of $1,250,000 in 
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cash, $26,155,000 in closely held companies (such as the taxi medallion entities'and his real estate 
holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence. 

j. Based on my review of reports of law enforcement interviews of Sterling 
Employee-1,1 have learned that Sterling Employee-1 reviewed each line of the May 2017 F inancial 
Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee-1 asked 
Cohen about the cash amount listed on the May 2017 Financial Statement. Cohen stated to Sterling 
Employce-l-,.-in-sum and substance,-:that-the-May-20:k7-Financial Statement was accurate. 

k. On or about August 16, 2017, Sterling Employee-1 emailed Cohen at the Cohen 

Account an it the |^^^|Account, attaching a non-binding term 

sheet memorializing the potential transaction between Sterling, Melrose, Cohen, and 

On or about August 29, 2017, ^^^emailed Sterling Employee-1 from the 
Account, requesting that he be included on “all future e-mails to and/or 

concerning this matter,” and providing proposed edits to the term sheet. On or about 
August 30, 2017, Sterling Employee-1 emailed at the 

Account, Cohen at the Cohen Account, and at the Account, and provided them with a 

revised term sheet. On or about September 5, 2017, Sterling Employee-1 sent 
at the ^^^^^^^^^^^4ccount, Cohen at the Cohen Account, and at the ^^^^ccount a 
copy of the executed term sheet. According to the term sheet,would borrow 
$20,000,000 from Sterling and Melrose, to be secured by the medallions that jwas to 

acquire from Cohen. 

l. Aspartofthe agreement, according to the term sheet, $1,265,913 in principal (which 
is what would remain after the $20,000,000 payment on the outstanding loan balance) would be 
repaid by Cohen and the two banks, with Cohen paying fifty percent and the banks dividing the 
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remaining half of the balance. Based on my review of an internal Sterling credit memorandum, 
dated October 4,2017, the parties reached a preliminary agreement that Cohen would pay $632,956 
of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb 
$357,167 and $275,789 respectively in the form of charge-offs. According to Sterling Employee- 
1, Sterling was willing to divide the repayment of the outstanding principal balance—despite its 
prior insistence that Cohen make a principal pay-down of at least one million dollars—because 
Cohen represented on a telephone call with Sterling Employee-!,-hr sum and subslancc, that he had 
insufficient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling 
and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made 
on behalf of the LLCs. Thus, after completing the ransaction, Cohen would no longer 

have had any outstanding obligations to Sterling or Melrose. 

m. Based on my review of emails sent by Sterling employees, I have learned that 
because the transaction between the parties was subject to full credit underwriting by Sterling and 
Melrose (as well as Melrose’s regulators at NCUA), in August and September 2017, Sterling 
required and requested additional financial statements for Cohen and jftr its credit 

underwriting process. In response to Sterling’s requests, on or about October 5, 2017, I 
sent from the . Account to a Sterling employee a copy of 

personal financial statement. The financial statement lists the 
Account as the email contact for Additionally, on or about October 5, 2017, 

Cohen, using the Cohen Account, re-sent Sterling Employee-2 a copy of his May 2017 Financial 
Statement. A day later, on October 6, 2017, Cohen, using the Cohen Account, emailed Sterling 
Employee-2 a statement of financial condition, dated September 30, 2017 (the “September 2017 
Financial Statement”). 
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n. Like the May 2017 Financial Statement, the September 2017 Financial Statement 
included a cover letter from Jeffrey Getzel, Cohen’s accountant, stating, in sum and substance, that 
the information in the statement came from Cohen, and that Getzel had not confirmed its accuracy 
or completeness. The September 2017 Financial Statement stated that Cohen had total assets of 
$33,430,000, total liabilities of $45,630,000, and a negative net worth of $12,200,000. Notably, 
unlike Cohen’s May 2017 Financial Statement, the September 2017 Financial Statement 


represented to Sterling that Cohen had- a negative net-worth—-The-September 2017 Financial 


Statement indicated that Cohen’s assets were comprised of $1,250,000 in cash, $17,630,000 in 
closely held companies (such as the taxi medallion entities and his real estate holdings), 5 
$3,200,000 in real estate investments, and his $ 11,000,000 personal residence (which, for the first 
time, he indicated was held in trust). The September 2017 Financial Statement included assets and 
liabilities not held in Cohen’s name, such as various entities associated with his taxi medallions and 
some of his real estate investment entities. 

o. From my participation in an interview with Sterling Employee-2, and my review of 
records maintained by Sterling, I have also learned that at or around the time Cohen provided 
Sterling with these financial statements—in or around September 2017—Cohen stopped paying 
monthly loan payments on his taxi medallion loans altogether. According to Sterling Employee- 
2, Cohen informed Sterling, in sum and substance, that he had insufficient funds to pay the monthly 
principal and interest payments on his medallion loans. By in or about December 2017, Sterling 
and Melrose had not been paid approximately $276,937.92 in monthly principal and interest 
payments on the medallion loans. Based on Cohen’s financial condition as conveyed in the 


5 Notably, the September 2017 Financial Statement valued each of Cohen’s thirty-two New 
York taxi medallions at approximately $180,187.50, whicj^wfl^considerably less than the 
$650,000 valuation ascribed to each medallion in the Coher term sheet. 
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September 2017 Financial Statement, and his delinquency in making payments to Sterling, among 
other things, the bank’s credit underwriting committee determined (and memorialized in a 
December 2017 memorandum) that the Coher^^^^^| transaction was favorable for the bank 
- that is, tha vould be a better borrower than Cohen. 

p. On or about December 26, 2017, Sterling sent Cohen a demand letter requesting 
the immediate receipt of past-due loan payments. On December 29, 2017, Sterling sent Cohen a 
letter statingjfaat he was in default under the loans jetween Sterling and Cohen’s medallion 

corporations. Cohen did not make an immediate payment on the loans, but instead sent an e-mail 
to Sterling Employee-1 on or about January 24,2018, from the Cohen Account, stating that during 
the closing of the Cohen transaction, Cohen would “bring all payments up to date as 

well as deposit the payoff differential.” Cohen also requested by email sent from the Cohen 
Account on January 24, 2018, that at the closing of the Cohen-' transaction, Sterling 

provide a letter stating that all of Cohen’s debts have been satisfied and that Cohen’s personal 
guarantees of the medallion loans had been terminated. 

q. The Coher ^^^^|transaction, however, did not close. On or about January 
29, 2018^^^^the^^^^^^^^.ttomey, emailed attorneys for Sterling from the^^^Vtccount 
and stated that “at this time there is no deal with Michael Cohen. Some of the numbers have 
changed and we are not prepared to go forward.” 

r. Based on my participation in the interview with Sterling Employee-2 and my 

review of records maintained by Sterling, I know that after the Cohen- jdeal fell apart, 

Sterling assigned Cohen’s loans to an employee at Sterling who specializes in collecting on 
defaulting loans (“Sterling Employee-3”). From my review of telephone call notes, I know that 
Sterling Employee-3 spoke to Cohen on or about January 30, 2018 about paying down and/or 
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restructuring Cohen’s outstanding taxi medallion loans. Based on my review of an email between 
Sterling Employee-3 and Cohen, I know that on the January 30, 2018 call, Cohen stated that he 
would send a “corrected current” version of his personal financial statement. Following that call, 
on or about January 31, 2018, Cohen emailed Sterling Employee-3 from the Cohen Account a 
copy of the September 2017 Financial Statement. Later that day, Cohen again emailed Sterling 
Employee-3 from the Cohen Account and proposed paying $500,000 to bring the loans current 
and $750,000 to bring the principal balanceto $20 r 500,000;:Cohen also suggested revised monthly 


interest payment amounts. On or about January 31, 2018, Sterling Employee-3 responded to 
Cohen at the Cohen Account and stated, in sum and substance, that Cohen would need to pay the 
entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 
(in total, a payment of approximately $1,750,000), and would need to make larger monthly interest 
payments. 


s. On or about February 1,2018, Cohen emailed Sterling Employee-3 from the Cohen 
Account and proposed “[p]ayment of $1.250m which ALL can be used to pay down principal, if 
[Sterling] will waive past due amounts,” but stated “I do NOT have more than the $1.250m.” 
(Emphasis in original.) Cohen also stated, in sum and substance, that he had insufficient financial 
resources to post additional collateral or pre-fund monthly payments. Based on my participation 
in an interview with Sterling Employee-2,1 have learned that Sterling continues to renegotiate the 
medallion loans with Cohen based on Cohen’s representations about his current financial position. 
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C. Cohen Made Material Misrepresentations About His Finances to Banks 

Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 

15. As set forth in detail below, despite multiple representations by Cohen to Sterling (and, 
by extension, Melrose 6 ) that he had insufficient funds to pay down the principal balance of the 
medallion loans, make monthly interest payments, or pay past-due amounts, it appears that 
between 2016 and the present, Cohen opened and maintained bank accounts at First Republic Bank 
(“Firs t R e pu blic'*’), and then received millions of dollars in purported consulting payments in these 
accounts, which he did not disclose to Sterling. Cohen set up these accounts and received these 
funds during the very period in which he made disclosures to Sterling about his personal finances 
(including his assets and liabilities) and his ability to make payments on the medallion loans. In 
these disclosures to Sterling—and despite being asked about these bank accounts by his 
accountant—Cohen withheld information about liquid financial assets at First Republic. 

16. Specifically, based on my review of documents and bank records produced pursuant to 
a subpoena by First Republic, and my participation in and review of reports of interviews with two 
First Republic employees, I have learned, among other things, the following: 

a. Cohen and his wife have been customers of First Republic since approximately 
June 2011. Cohen controls several checking and loan accounts, some in his own name and others 
in the names of corporate entities. 


6 Based on my review of a report of an interview conducted with an employee of Melrose, I 
have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen’s 
financial statements and other records in Sterling’s possession were forwarded to Melms^fUhat 
Melrose could make a determination as to whether to approve of the Cohen-1 
transaction. Based on my review of reports of interviews jmployees, 1 also Know 

that Cohen called employees at Melrose regarding the Cohen ransaction. 
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b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new 
checking account at First Republic in the name of Essential Consultants LLC (the “Essential 
Consultants Account”). Cohen was the only authorized signatory on the account. When Cohen 
opened the Essential Consultants Account, a First Republic employee (“First Republic Employee- 
1”) conducted an in-person interview of Cohen. In response to a series of know-your-customer 
questions 7 8 about the purpose of the account—the answers to which First Republic Employee-1 
entered-intova^form^-^Cohenstated,—imsum-and-substanee^-that-hewas^jpeningEssential 


Consultants as a real estate consulting company to collect fees for investment consulting work, 
and all of his consulting clients would be domestic individuals based in the United States. Cohen 
also stated, in sum and substance, that his purpose in setting up the account was to keep the revenue 
from his consulting business—wh ich he said was not his main source of income—separate from 
his personal finances. As set forth below, there is probable cause to believe that Cohen’s 
statements about the intended purpose of the account and source of funds for the account were 
false. Specifically, the account was not intended to receive—and does not appear to have 
received—money in connection with real estate consulting work; in addition, the account has 
received substantial payments from foreign sources. 

c. First, on or about October 27, 2016—the day after he opened the Essential 
Consultants Account, Cohen used the account to wire $130,000 to an account held in the name of 
attorney Keith Davidson’s law firm. Based on my review of emails between Cohen and Davidson, 


7 Certain financial institutions are required to conduct such procedures pursuant to the Bank 
Secrecy Act and its implementing regulations. See 31 U.S.C. § 5318; 31 C.F.R. § 1020.220. 

8 First Republic Employee-1 first filled out the form on the day he interviewed Cohen, October 
26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First 
Republic Employee-1 updated the form to add more detail about Cohen’s statements. 
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obtained pursuant to the Prior Cohen Account Warrants, I believe that this payment did not relate 
to any real estate consulting work, but rather was a “settlement” payment made to Davidson’s 
client. 9 Based on my review of public sources, I have learned that Davidson’s client is alleged to 
have had an extramarital affair with Donald Trump. On or about February 13, 2018, Cohen made 
a public statement that “[i]n a private transaction in 2016, I used my own personal funds to 
facilitate a payment of $130,000 to [Davidson’s client].” 

rrT^~=.-r~r = d.:::Sccond,-I-know:frommyu‘eview-o£First-Rcpublicbankrecordsthatwerescheduled 
by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen 
received payments into that account from foreign businesses and entities that do not reflect the 
stated client profile for the residential and commercial real-estate consulting services. Specifically, 
from my review of the Essential Consultants Account schedule and public sources, I know the 
following: 

i. Beginning on or about January 31, 2017, Cohen began receiving monthly 
payments of $83,333 from an entity called Columbus Nova LLC, which were deposited into the 
Essential Consultants Account. According to public sources, Columbus Nova is an investment 
management firm controlled by Renova Group, an industrial holding company based in Zurich, 
Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to 
August 2017, the Essential Consultants Account received seven payments totaling $583,332.98 
from Columbus Nova LLC. 

9 Specifically, I have learned from my review of bank records that on or about October 26, 
2016, Cohen transferred $131,000 from a home equity line of credit account at First Republic to 
the Essential Consultants Account; on or about October 27, 2016, Cohen transferred $130,000 
from the Essential Consultant Account to an account held in the name of Davidson’s law firm at a 
bank based in Los Angeles; and on or about November 1, 2016, a wire transfer in the amount of 
approximately $96,645 was made from Davidson’s account to a bank account in the name of 
Davidson’s client. 
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ii. Beginning on or about April 5,2017, Cohen began receiving payments from 
Novartis Investments, SARL, which I believe to be the in-house financial subsidiary of the Swiss 
pharmaceutical company Novartis International AG (“Novartis”). Between April 2017 and January 
2018, the Essential Consultants Account received ten wire payments from a Swiss bank account 
held in the name of Novartis, each in the amount of $99,980, for a total of $999,800. 

iii. Beginning in or about April 2017, the Essential Consultants Account started 


receiving wire payments from a bank'account associated with the telecommunications company 
AT&T Inc. (“AT&T”). Specifically, on or about April 14, 2017, AT&T wired $100,000 to the 
Essential Consultants Account and, from in or about June 2017 to in or about January 2018, the 
Essential Consultants Account received nine $50,000 payments from AT&T. In total, AT&T wired 
$550,000 to the Essential Consultants Account. 

iv. On or about May 10,2017, June 9, 2017, July 10, 2017, and November 27, 
2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling. 
$600,000) from a bank account in South Korea. The account holder from which the money was 
sent is Korea Aerospace Industries Ltd. (“KAI”). KAI is a South Korea-based company that 
produces and sells fixed-wing aircraft, helicopter aircraft, and satellites to the United States 
Department of Defense, among other customers. 

v. On or about May 22, 2017, the Essential Consultants Account received a 
$150,000 deposit from an account at Kazkommertsbank, a Kazakhstani bank. The listed account 
holder at Kazkommertsbanlc was a second Kazakhstani bank named BTA Bank, AO. A message 
accompanying the wire payment indicated that the payment was a “monthly consulting fee as per 
Inv BTA-101 DD May 10, 2017 consulting agreement W/N DD 08 05 2017 CNTR W/NDD 


08/05/2017.” 


02 . 28.2018 


23 










Case l:18-cr-00602-WHP Document 48-4 Filed 07/18/19 Page 59 of 105 


vi. In total, from on or about January 31, 2017 to on or about January 10,2018, 
the Essential Consultants Account received approximately $2,883,132.98 in transfers and checks 
from the aforementioned entities. As of on or about January 10, 2018, the balance in the Essential 
Consultants Account was $1,369,474.23. 

e. On or about April 4, 2017, Cohen opened another new checking account at First 
Republic, this one in the name of Michael D. Cohen & Associates, P.C. (the “MDC&A Account”). 

—-Cohen was the only authorized signatory on the account.- Among other things, the MDC&A 
Account received ten wire transfers and one check from an account in the name of Squire Patton 
Boggs, a law firm. In total, from on or about April 5, 2017, to on or about January 2, 2018, the 
MDC&A Account received $426,097.70 in deposits, and the balance in the account as of January 
2, 2018, was $344,541.35. As discussed below, Cohen never disclosed any of the balance in the 
Essential Consultants or MDC&A accounts to Sterling during the negotiations with respect to the 
•ansaction, including in his May 2017 Financial Statement and September 2017 
Financial Statement. 

17. Based on my review of emails from the Cohen Account that were seized pursuant to 
the Prior Cohen Account Warrants, and my review of reports of interviews with employees of 
AT&T and Novartis, it appears that the aforementioned payments to the Essential Consultants 
Account and MDC&A Account ostensibly were for political consulting work, including consulting 
for international clients on issues pending before the Trump administration. 10 Specifically, from 
my review of emails from the Cohen Account and public sources, I have learned the following: 



10 Based on my review of public sources, I have learned that Cohen is not registered as a 
lobbyist or as a person acting as an agent of foreign principals, as may have been required by the 
Foreign Agents Registration Act. 
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a. On or about April 28, 2017, Cohen sent an email from the Cohen Account to an 

individual whom I believe is affiliated with KAI. In the email, Cohen attached a document 
purporting to be a “Consulting Agreement” between KAI and Essential Consultants dated as of 
about May 1, 2017. The document indicates that Essential Consultants would render “consulting 
and advisory services, as requested” by KAI, and that KAI would pay Essential Consultants “a 
consulting fee of One Million Two Hundred Thousand ($1,200,000.00) US Dollars,” disbursed 
thro-ughTeight--$lA0j000-installment-SzbetweemMay=2-017-andrDecembe£T01 ^ r^ ^^ ^ ^.^ ^__ •... 

b. On or about May 10, 2017, Cohen sent an email from an alternate email address, 
copying the Cohen Account, to an employee of BTA Bank. To the email, Cohen attached an 
invoice to BTA Bank in the name of Essential Consultants. The invoice contemplated a $150,000 
payment to Essential Consultants for a “monthly consulting fee.” 

c. On or about February 13,2017, Cohen emailed an AT&T employee from the Cohen 
Account what appears to be a consulting agreement, which contemplates that Essential Consultants 
“shall render consulting and advisory services to [AT&T]” and that AT&T would “advise [Essential 
Consultants] of those issues and matters with respect to which AT&T Services desires [Essential 
Consultants]’s assistance and advice.” The contract calls for AT&T “to pay the Consultant for his 
services ... a consulting fee of Fifty Thousand ($50,000) Dollars . . . per month.” Based on my 
review of reports of interviews with AT&T employees, I have learned that AT&T retained Cohen 
to consult on political issues, including net neutrality, the merger between AT&T and Time Warner, 
and tax reform. 


d. On or about January 17, 2017, Cohen emailed to a representative of Novartis from 
the Cohen Account a contract between Novartis and Essential Consultants, which provides that 
Essential Consultants will “provide consulting and advisory services to Novartis on matters that 
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relate to the repeal and replacement of the Affordable Care Act in the US and any other issues 
mutually agreeable to [Essential Consultants] and Novartis.” The contract provides for a 
“consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,” to be paid to 
Essential Consultants in even monthly installments over the course of a year. Based on my review 
of reports of interviews with Novartis employees, I have learned that Novartis retained Cohen to 
provide political consulting services and to gain access to relevant policymakers in the Trump 
-Administratio n;— ■ ——— — — = — 


e. On or about April 3, 2017, Squire Patton Boggs, a law firm, announced on its 
website that is had formed a “strategic alliance” with Michael D. Cohen & Associates and would 
“jointly represent clients.” 

18. Despite the significant amount of money that Cohen received into the Essential 
Consultants Account and the MDC&A Account, and the cash balance in both accounts, Cohen did 
not disclose that information to Sterling or Melrose. Specifically, based on my review of documents 
by Getzel, my notes j 1 

have learned the following: 

a. In or about May 2017, Getzel met with Cohen at a law firm in Manhattan, New 
York. At the meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice 
called Michael D. Cohen & Associates P.C., and a consulting company called Essential Consultants 
LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in 
connection with his law practice, and that he expected gross revenues for the consulting business to 
be between five and six million dollars annually. 

b. In or about October 2017, if not earlier, Getzel was preparing a personal financial 
statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen at the Cohen 
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Account in which Getzel wrote that “[a]ttached is a draft of the newPFS as of September 30,2017” 
and attached a draft of the September 2017 Financial Statement. The draft statement reflected that 
as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately 
$33,430,000 (comprised of taxi medallion interests, real estate interests, and his personal residence 
and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 
million in debt. In the same email, Getzel questioned Cohen, in sum and substance, about the fact 


that the-financial statementdid notdist any assets associated'with either the Essential-Consultants 


Account or the MDC&A Account: “[w]e did not add any value for you[r] two operating entities - 
Michael D. Cohen & Associates POC [v/c] and Essential Consultants LLC. Please advise whether 
or not these should be disclosed and what value.” 

c. On or about October 6,2017, Cohen called Getzel by telephone—which is reflected 
on toll records for Cohen’s cellphone—and told Getzel, in sum and substance, not to include 
Essential Consultants or MDC&A in the September 2017 Financial Statement because they had no 
value. 

d. On or about October 6,2017, following the call with Getzel, Cohen, using the Cohen 
Account, responded to Getzel’s email with the answer “[ljoolcs good to me.” Cohen never directed 
Getzel to make any changes to his cash position as listed in the September 2017 Financial 
Statement. Neither Essential Consultants nor MDC&A was listed on the September 2017 Financial 
Statement that was provided to Sterling. 

19. Based on the foregoing, and from my review of bank records and emails sent by Cohen 
to Sterling, I know that the September 2017 Financial Statement made no mention whatsoever of 
assets that Cohen held in the Essential Consultants Account or the MDC&A Account. As of 
September 30, 2017—the date of the September 2017 Financial Statement—Cohen had 
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approximately $673,729.95 in the Essential Consultants Account and $248,619.28 in the MDC&A 
Account. As of October 6,2017, the date when Getzel asked Cohen about the two accounts, Cohen 
had approximately $823,709.95 in the Essential Consultants Account and $248,619.28 in the 
MDC&A Account. 

Cohen Understated His Available Cash 

20. In addition to withholding the existence of the Essential Consultants Account and the 
MD C&A A c co unt from Sterling-andMelrose,- ita ppears.that-Coh.en also ,s ubstantialLy_understated._ 
his available cash and cash equivalents in his financial disclosures. Specifically, I know from my 
review of the September 2017 Financial Statement that Cohen provided to Sterling that Cohen 
represented that he had $1,250,000 in cash as of September 30, 2017. But, from my review of a 
summary of bank records that were scheduled by an FBI forensic accountant, I have learned that 
Cohen had over $5,000,000 in cash and cash equivalents as of September 30, 2017. Specifically, 
from my review of the account schedule and bank records, I have learned the following: 

a. Cohen has three checking and/or savings accounts at Capital One Bank, one of 
which is in his wife’s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings 
account, and $1,262,982.29 in total in the three accounts at Capital One Bank. 

b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 
2017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41. 

c. As of September 30,2017, Cohen had $260,689.18 in an account at Signature Bank. 

d. In addition to the Essential Consultants Account and MDC&A Account at First 
Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, 
as of September 30, 2017, Cohen had at least $1,876,209.27 in total in his four accounts at First 
Republic. 
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e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of 
September 30, 2017. 

f. As of September 30,2017, Cohen had $17,542.54 in accounts at Sterling. 

g. Cohen has two accounts at TD Bank—one in his name and one held jointly with his 
wife—and the total balance across the two accounts as of September 30, 2017 was $300,096.72. 

h. In total, as of September 30,2017, Cohen had at least $5,014,051.80 in his accounts 
at-Capital One Bank,-Signature -Bank? TD- Bank 7 ^Bcthpage Credit Union, =First-Republic,- - and 
Morgan Stanley. 

21. Accordingly, based on the foregoing, it appears that Cohen’s representations to Sterling 
and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld 
information regarding approximately $5 million in funds from Sterling and Melrose in order to 
secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an 
interview with Sterling Employee-2, and my review of reports of interviews with Sterling 
Employee-1 and two Melrose employees, it is my understanding that that Sterling and Melrose 
would view Cohen’s understating of his assets as material to its decision whether to renegotiate 
Cohen’s medallion loans and on what terms, or approve of the transfer of those loans to 




Cohen Had a Side Agreement With 


22. As set forth in detail below, it appears that during the course of Cohen’s negotiations to 


sell his interest in taxi medallions and the associated debt to 



Cohen not only 


misrepresented his financial position to Sterling, but also failed to disclose a side deal he had 


negotiated with 



it appeal's that 



tgreed to pay an above-market price for 


Cohen’s taxi cab medallions, and in exchange, Cohen agreed to pay 



pproximately 
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$3.8 million in cash. Specifically, from my review of documents produced pursuant to a subpoena 
by Sterling, and reports prepared by law enforcement officers of interviews with Sterling 
Employee-1, as well as my participation in an interview with Sterling Employee-2,1 have learned, 
among other things, the following: 

a. On or about September 5, 2017, an executed term sheet was circulated by Sterling 


Employee-1 to Cohen and 


See supra 14(k). According to the term sheet. 



vould borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions— 


vas to acq uire from Cohen. At a price of $20 million for thirty-two taxi medallions, 
the proposed transaction valued each medallion as worth $625,000. The term sheet also 
contemplated a $1,265,913 pay-down of the principal balance of the loan. The term sheet made no 

or any other form of payment or 


mention of a $3.8 million payment from Cohen to 
financial transaction between the parties. 

b. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, 


describing the terms of the Cohen-’ 1 
not mention any payments from Cohen to 


transaction and the new loan to 


including a $3.8 million payment. The 


memorandum also noted that the “loan amount of $20MM indicates a $625M purchase price per 
medallion” but “it is recognized that this is not in line with current market values.” Indeed, 
according to an internal Sterling memorandum dated February 5, 2018, in the month of January 
2018, taxi medallions sold for amounts ranging from $120,000 to $372,000. According to Sterling 

agreed to a purchase 


Employee-1 and Sterling Employee-2, they were never told thatl 
price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make 
any payment to 
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23. While Cohen and did not disclose any payment from Cohen to 

in communications with Sterling, it appears that such a payment was contemplated. 
Indeed, based on my review of records maintained by Getzel, and a report prepared by law 
enforcement agents of an interview with Getzel, I have learned the following, in substance and in 
part, regarding the proposed side-payment from Cohen to 

a. On or about September 19, 2017, Getzel prepared a memorandum for Cohen 
entitled;-“Salemf4SlYG4Vledallion Entities=and-Debt--Assumption 5 F(the “Getzel--Memorandum”).- 
The Getzel Memorandum summarized the proposed transaction between Cohen and 

in part, as follows: “Michael and Laura Cohen will transfer ownership of their 13 NYC medallion 
entities to a Buyer who will assume their bank indebtedness, upon the [Cohens’] paying down the 
debt portfolio of the 13 entities by $500,000 and a cash payment to the Buyer of $3,800,000.” n 

b. According to Getzel, Cohen told h i m the parameters of the deal, including the 

payment of $3,800,000 to , but Getzel did not know where Cohen was going to obtain 

$3,800,000 to pa;; As noted above, Cohen had more than $5,000,000 in cash and 

cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial 
Statement that he had $1.25 million in cash. 

24. Based on my review of records maintained by Sterling (as well as Melrose, the bank 

with the participating interest in the loans) and reports of interviews of representatives of Sterling 
(and Melrose), I have seen no evidence that Sterling, Melrose, or any other financial institution 
involved in the potential deal with Cohen and ^^ was aware of the planned $3.8 million 

side payment from Cohen to 


11 The reference to thirteen medallions appears to be an error by Getzel. Cohen and his wife 
together owned sixteen corporations, which in turn owned 32 taxi medallions. 
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D. Probable Cause Regarding the Subject Accounts 

25. As set forth above, since at least September 2015, if not earlier, Cohen has told Sterling 
that he has difficulty making payments on his medallion loans and, since at least October 2016, 
Cohen has been actively engaged in an attempt to sell his taxi medallions and the associated debts 
tc In the course of doing so, Cohen has used the Cohen Account and/or MDCPC 

Account to engage in email communications regarding the terms of the transactions and the 


^undisclo se d—side-pa yment —wi t b | 
it the 



at-the 



\ccount, and 



Account,_B 
Account. Specifically, 


as described above, there is probable cause to believe that the Subject Accounts have been used 
regarding the proposed Cohen transaction with Sterling: 

a. Cohen has used the Cohen Account to, among other things, negotiate a pay-down 
of the principal amount of the loan, see supra 14(g), to send term sheets to Sterling, see supra f 
14(j), to communicate with his accountant about the contents of financial statements, see supra If 
16, to send financial statements to Sterling, see supra If 14(i), (1), to check on the status of the 
transaction as of January 24, 2018, see supra If 14(n), to negotiate a reduction of his debt with 
Sterling on or around January 31, 2018, see supra If 14(o), to tell Sterling on February 1, 2018, he 
does not have the ability to pay more than $ 1,250,000, see supra If 14(p), and to communicate with 
individuals responsible for sources of payments to the Essential Consultants Account, see supra f 
15. In other words, from the communications described above, it appears likely that the Cohen 
Account will contain recent evidence of the Subject Offenses, including communications and 
potential misrepresentations to Sterling, and evidence indicating that statements made to Sterling 
are false or misleading. 


I has used the 


Account to communicate about 


the proposed taxi medallion transaction with Cohen, which appears to have been discussed as early 
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as October 2016. See supra If 14(g). 12 Specifically, as described above, as early as May 2, 2017, 
lused the Account to inquire about the status of the transaction, 

see supra U 14(h). He used the Account to exchange drafts of the proposed term 


sheet with Cohen J 
used by .1 
see supra If 14(1). Tht 


md Sterling, see supra If 14(j). The 
to send a personal financial statement foi 

lAccount was copied on emails from the , 



Account was also 
to Sterling, 


“Accountaboutthc'transactionf-see-=^Mpra~-Tf—f4(i)—and=-was--listed“onH 


financial- 


statement as the contact email fo see supra ^ 14(m). Additionally, based on my 

review of MDCPC Header Information, I know that on or about September 1, 2017—at or around 
the time the and Cohen were negotiating a term sheet- |used the 

Account to send and receive eight emails from Cohen at the MDCPC Account, 
c. las used the ^^.ccount to communicate with Sterling employees, Cohen, 

and ibout the proposed taxi medallion transaction since at least December 2016. 

See supra Ifif 14(g), 24(c). Specifically, on or about August 29, 2017,^^j old Sterling that he 
should be included on “all future e-mails” involving the proposed transaction, see supra ]f 14(j). 
Additionally, vas involved in making revisions to the parties’ term sheets, and he told 

Sterling on January 29, 2018 that ^^^^vould not go forward with the planned transaction, 
see supra If 14®, (n). Accordingly, there is probable cause to believe that the Account will 
contain evidence of the negotiations between Sterling and the parties, evidence of a payment from 
Cohen to and the reasons for the collapse of the Cohen- transaction. 


12 Forinstancc, from records provided by Sterling, I know that on or about December 2 , 
2016.H|^|^^^^^^Bsent an email to a Sterling emplovee using the. 

Account. The email forwarded correspondence between who was using the] 

Account, and an employee of Capital One regarding extending 
Capital One. 




>an with 
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26. Additionally, it appears that Cohen set up the MDCPC Account to receive emails he 
. was previously receiving at the Cohen Account. Specifically, based on my review of records 
maintained by AT&T, I have learned that on or about May 5, 2017, Cohen sent an email from the 
MDCPC Account to a blind copy list of recipients stating that “[d]ue to the overwhelming volume 
of phone calls and emails coming into my previous cellular number and e-mail address, I have 
elected to create for Clients Only the following. Kindly use this new information for all future 
contact and communications';-” The signature line onthe-email listed “Essential Consultants LLC” 
and “Michael D. Cohen & Associates, PC,” as well as the MDCPC Account as the email address. 13 

27. In addition, based on my review of emails from the MDCPC Account produced 

pursuant to the Prior Cohen Account Warrants and the MDCPC Header Information, I have learned 
that Cohen has used the MDCPC Account to send and receive emails from the Cohen Account, to 
communicate with the Vccount, and to send and receive emails from other email accounts 

about his political consulting business. Additionally, from my review of the MDCPC Header 
Information, it appears that since the November 13,2017 search warrant on the MDCPC Account, 
Cohen has continued to send and receive emails at the MDCPC Account that appear likely to be 
relevant to the commission of the Subject Offenses. For example, emails obtained pursuant to the 
Prior Cohen Account Warrants, as well as the MDCPC Header Information have revealed the 
following: 

a. On approximately eight occasions in August and September 2017, while Cohen, 
ere communicating about a term sheet for the Cohen taxi 


13 Based on my review of emails from the MDCPC Account obtained pursuant to subpoena, I 
have learned that Cohen has used the account to communicate with numerous individuals with 
whom he does not enjoy an attorney-client privilege, including some of the individuals described 
below. See infra ^ 27. 
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medallion transaction, see supra If 14(k), Cohen used the MDCPC Account to send or receive 
emails froni at the Vccount. For instance, on or about August 22, 2017, ^^|used 

th« jj Account to send an email to Sterling Employee-1 and copied Cohen on the email at the 
MDCPC Account. On the same day, Sterling Employee-1 responded tc t the 

and Cohen at the MDCPC Account. On or about August 22, 2017, Cohen also used the MDCPC 
Account to send an email to Sterling Employee-1. 

b’---:Asnotodaboveyorfor about-Septcmber Tf20T7, Gohemused the MDCPC Account 
to send or receive eight emails with the j^^^^^^^^Jkccount. 

c. Cohen used the MDCPC Account to send and receive emails from individuals who 
work at companies with whom it appears Cohen has a political consulting agreement. For 
example, beginning in April 2017—the same month when Cohen began receiving payments from 
AT&T, see supra 16(d), 17(c)—Cohen used the MDCPC Account to send and receive emails 
from AT&T employees. These emails contain, among other things, invoices from Cohen to AT&T 
for consulting work by Cohen. Similarly, beginning in April 2017—which is also the month 
Cohen began receiving payments from Novartis for consulting work, see supra fflf 16(d), 17(d)— 
Cohen used the MDCPC Account to send and receive emails from employees of Novartis. These 
emails concern, among other things, invoices from Cohen and requests for Novartis for Cohen’s 
assistance on an initiative relating to drug pricing. 

d. From my review of the MDCPC Header Infonuation, I have learned that Cohen has 
continued to use the MDCPC Account to send and receive emails from individuals who work at 
companies with whom it appears Cohen had a political consulting agreement, such as Novartis and 
AT&T. For instance, on approximately six occasions between November 28, 2017 and January 
30, 2018, the MDCPC Account was used to send and receive emails from accounts belonging to 
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individuals using @att.com email addresses. Similarly, on approximately seventeen occasions 
between December 1, 2017 and February 20, 2018, the MDCPC Account was used to send and 
receive emails from accounts belonging to individuals using @novartis.com email addresses. 
Since November 15,2017, the MDCPC Account has also sent and received emails with individuals 
using the email domains @bta.kz, which I believe is the email domain used by employees of BTA 
Bank, see supra 16(d), 17(b), and @squirepb.com, which I believe is the email domain used by 
employees of the l aw firm Squire Patton B oggs—both of which Cohen appears to have a 


consulting relationship with, see supra 16(e), 17(e). Accordingly, it appears that Cohen 
continues to use the MDCPC Account to send and receive emails that will be relevant to whether 
he is maintaining a consulting business, what type of consulting work he is doing, and whether he 
is receiving money for that consulting work. 

28. In addition to the foregoing, based on my review of the Pen Register Data, see supra 
9, it appears that since the date of the last search warrant on the Cohen Account (i.e., November 
13, 2017), Cohen has continued to use the Cohen Account to communicate with the I 

| Account, the ^^Account, and other email accounts that appear likely to be relevant 
to the commission of the Subject Offenses described above. For example, the Pen Register Data 
has revealed the following: 

a. Emails sent by the Cohen Account to the Account on or about December 18, 

2017 at 8:26 p.m., December 21, 2017 at 9:35 p.m., December 22, 2017 at 4:32 p.m., January 3, 

2018 at 8:01 a.m., January 3, 2018 at 2:56 p.m., and January 4, 2018 at 3:31 p.m. 

b. An email sent by the Cohen Account to Account on or about 

January 25, 2018 at 8:55 p.m. 
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c. Emails from the Cohen Account to the email account 



on or 


about December 1, 2017 at 2:14 p.m., December 29, 2017 at 10:20 p.m., January 2, 2018 at 3:52 
p.m., January 2, 2018 at 5:44 p.m., and January 8, 2018 at 6:38 p.m. Based upon my review of 



t email account 


emails contained in the Cohen Account, I have learned that the 


belongs to Jeffrey Getzel, Cohen’s accountant, through whom Cohen made misrepresentations to 
financial institutions, as discussed above. 

• dr'-Emails from the Cohen Account to'email accounts belonging to Sterling employees,- 
including Sterling Employee-1, on or about January 25, 2018 at 10:23 p.m., January 26, 2018 at 
12:55 a.m., January 29,2018 at 5:30 p.m., January 29, 2018 at 8:29 p.m., January 30, 2018 at 6:44 
p.m. 


e. An email sent from the Cohen Account to the email account 


clientserviceny@firstrepublic.com on or about January 25, 2018 at 5:29 p.m. As stated above, 
First Republic is the bank at which the Essential Consultants Account is held. 


f. Numerous emails sent from the Cohen Account to the email account 



including emails on or about December 4, 2017 at 2:17 p.m. and January 29, 


2018 at 5:43 p.m. Based upon the email address and domain name, as well as my review of reports 
of interviews and documents reflecting that Cohen’s taxi medallions were leased and operated by 




email address belongs to 


I believe that the 


29. Based on my review of records maintained by Sterling, I know that Cohen used the 


Cohen Account to send and receive documents related to the Cohen- 



transaction. 


Based on my training and experience, I know that Google allows users of e-mail accounts to easily 
save documents to file sharing and retention platforms such as Google Docs and Google Drive. I 
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also know, from my training and experience, that users of e-mail accounts often use instant 
messaging interfaces linked to their email accounts. Further, I have learned that the Providers 
maintain records of search and web histories associated with email accounts and, based on my 
training and experience, users of e-mail accounts use associated web search browsers associated 
with a subscriber’s account to research topics they are e-mailing about. Accordingly, there is 
probable cause to believe that content information associated with the Subject Accounts will also 
contain evidence related to the^SubjeeTOffenses.^- --—--~- : 

30. Thus, I respectfully submit that there is probable cause to believe that emails and other 
content information from the Subject Accounts will contain evidence of Cohen’s efforts to sell his 
taxi medallions and the associated debt, and his misrepresentations and omissions to Sterling and 
Melrose in connection with these negotiations. Although Cohen appears to have communicated 
with|j||^^^^^^^^^^^^^^^^^^^^^^^^^^|primarily the 

MDCPC Account, I know, based on my involvement in the investigation, that Cohen also used at 
least one other email account associated with his position at the Trump Organization. Thus, I 
respectfully submit that there is probable cause to believe that emails and other content information 
from th| Account, ^^^^|Account and Recount since on or 

about October 1, 2016—the approximate date of when Cohen’s efforts to sell his taxi medallions 
and the associated debt began—will reflect communications with the Cohen Account, MDCPC 
Account, and possibly one or more additional accounts used by Cohen, and probable cause to 
believe that such emails will constitute evidence of Cohen’s commission of the Subject Offenses, 
including the extent to which Cohen did or did not inform other individuals involved in the conduct 
described above—such as -of his misstatements and 

omissions to financial institutions. 
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31. Temporal Limitation . This application seeks all emails and other requested content 
information specified in Attachments A, B, C, and D for the following periods: 

a. For the Cohen Account, this application seeks all emails sent, created, or received 
between November 14,2017, and the date of the proposed warrant, inclusive. As described above, 
pursuant to the Prior Cohen Account Warrants, the SCO obtained and provided to the USAO 
emails from the Cohen Account that were sent, created, or received before November 14, 2017. 


This application also seeks other-information speeified above associated with the Cohen Account 


that was created between December 1, 2014 (the month when Cohen entered into the medallion 
loans with Sterling), and the date of the proposed warrant, inclusive. 

b. For the MDCPC Account, this application seeks all emails sent, created, or received 
between November 14,2017, and the date of the proposed warrant, inclusive. As described above, 
pursuant to a prior warrant, the SCO obtained and provided to the USAO emails from the MDCPC 
Account that were sent, created, or received before November 14, 2017. 

c. For the Account and Account, this application 

seeks emails and all other content information specified above sent, created, or received between 
October 1, 2016, and the date of the proposed warrant, inclusive. As described above, October 
2016 is the month in which Cohen began negotiating the taxi medallion sale with the 

d. For the Account, this application seeks emails and all other content 

information specified above sent, created, or received between December 1, 2016, and the date of 
the proposed warrant, inclusive. As described above, December 2016 is the month in which I 
began representing the n relation to the taxi medallion transaction. 

E. Evidence, Fruits and Instrumentalities 

32. Based upon the foregoing, I respectfully submit there is probable cause to believe that 
information stored on Google’s servers associated with the Cohen Account will contain evidence. 
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fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in 
Section II of Attachment A to the proposed warrant for the Cohen Account and MDCPC Account, 
including the following: 

a. Communications, records, documents, and other files necessary to establish the 
identity of the person(s) who created or used the Cohen Account or MDCPC Account. 

b. Communications, records, documents, and other files involving Sterling, Melrose, 


and/or taxi: medallions; 


c. Communications, records, documents, and other files involving a plan, proposal, or 

agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, 
and any associated debts or liabilities, to others, including to and/or entities 

associated with him; 

d. Communications, records, documents, and other files involving Essential 
Consultants, LLC or Michael D. Cohen & Associates, including those which indicate the nature 
and purpose of payments made to or from Essential Consultants or Michael D. Cohen & 
Associates; 


e. Communications, records, documents, and other files necessary to establish the 
identity of any person(s) - including records that reveal the whereabouts of the person(s) — who 
communicated with the Cohen Account and/or MDCPC Account about any matters relating to 
Essential Consultants, LLC, or about any plan or proposal or agreement for Cohen and/or entities 
associated with him to transfer any interest in taxi medallions, and any associated debts or 


liabilities, to others, including to 


Imd/or entities associated with him; 


f. Communications between the Cohen Account and/or MDCPC Account and Jeffrey 
Getzel relating to Cohen’s bank accounts, taxes, debts, and/or finances; 
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g. Communications, records, documents, and other files reflecting false 
representations to a financial institution with relation to the intended purpose of an account or loan 
at that financial institution; the nature of any business or entity associated with an account at a 
financial institution; the source of funds flowing into an account; or the purpose or nature of any 
financial transactions involving that financial institution; 

h. Evidence indicating how and when the Cohen Account and MDCPC Account was 
accessed or used, to determine the geographic-and chronological context of account access, use, 
and events relating to the crimes under investigation and to the account owner; and 

i. Evidence indicating the Cohen Account and MDCPC Account owner’s intent as if 
relates to the Subject Offenses under investigation. 

33. Based upon the foregoing, I further submit there is probable cause to believe that 


Account and 


information stored on Google’s servers associated with thJ 

I Account will contain evidence, fruits, and instrumentalities of violations of the Subject 
Offenses, including the following: 

a. Communications, records, documents, and other files necessary to establish the 



identity of the person(s) who created or used th| 
Account; 


Account and 


b. Communications, records, documents, and other files involving a plan or proposal 

or agreement for Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, and/or entities associated 

with him; 

c. Communications, records, documents, and other files necessary to establish the 
identity of any person(s) - including records that reveal the whereabouts of the person(s) - who 
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communicated with the Account and ^Account about any 

matters relating to any plan or proposal or agreement.for Cohen and/or entities associated with him 
to transfer any interest in taxi medallions, and any associated debts or liabilities, to 
and/or entities associated with him; 

d. Communications between the Account and 

Account and others, including employees or representatives of Sterling, Melrose, or other financial 

-institution^s)^regarding-6ohen-s^finances; -- —- — —== = == ======= 

e. Communications, records, documents, and other files reflecting false 
representations to a financial institution with relation to the intended purpose of an account or loan 
at that financial institution; the nature of any business or entity associated with an account at a 
financial institution; the source of funds flowing into an account; or the purpose or nature of any 
financial transactions involving that financial institution; 

f. Evidence indicating how and when the 
Account were accessed or used, to determine the geographic and chronological context 

of account access, use, and events relating to the crimes under investigation and to the account 
owner; 

g. Evidence indicating the ^^^^^^tccount and 

owners’ intent as it relates to the Subject Offenses under investigation. 

34. Based upon the foregoing, I further submit there is probable cause to believe that 
information stored on Oath’s servers associated with the Account will contain evidence, 

fruits, and instrumentalities of violations of the Subject Offenses, including the following: 

a. Communications, records, documents, and other files necessary to establish the 
identity of the person(s) who created or used tln^^H Account; 



Account and 
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b. Communications, records, documents, and other files involving a plan or proposal 

or agreement for Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to ind/or entities associated 

with him; 

c. Communications, records, documents, and other files necessary to establish the 

identity of any person(s) - including records that reveal the whereabouts of the person(s) - who 
communicated with the ^^ccounEabout-any-matters-relating to any plan or. proposal or-.- 
agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, 
and any associated debts or liabilities, and/or entities associated with him; 

d. Communications between the Account and others, including employees or 

representatives of Sterling, Melrose, or other financial institution(s), regarding Cohen’s finances; 
and 

e. Communications, records, documents, and other files reflecting false representations 
to a financial institution with relation to the intended purpose of an account or loan at that financial 
institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution. 

HI. Review of the Information Obtained Pursuant to the Warrant 

35. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for service of a search warrant issued under § 2703, or for the collection or production of 
responsive records. Accordingly, the warrant requested herein will be transmitted to the Providers, 
which shall be directed to produce a digital copy of any responsive records to law enforcement 
personnel within 30 days from the date of service. Law enforcement personnel (including, in 
addition to law enforcement officers and agents, and depending on the nature of the ESI and the 

43 
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status of the investigation and related proceedings, attorneys for the government, attorney support 
staff, agency personnel assisting the government in this investigation, and outside technical experts 
under government control) will retain the records and review them for evidence, fruits, and 
instrumentalities of the Subject Offenses as specified in Section III of Attachments A, B and C to 
the proposed warrant. 

36. In conducting this review, law enforcement personnel may use various methods to 


locale evidence, fruits, and instrumentalities 


of-the SubjectOffenses, including but not limited to 


undertaking a cursory inspection of all emails within the Subject Account. This method is 
analogous to cursorily inspecting all the files in a file cabinet in an office to determine which paper 
evidence is subject to seizure. Although law enforcement personnel may use other methods as 
well, particularly including keyword searches, I know that keyword searches and similar methods 
are typically inadequate to detect all information subject to seizure. As an initial matter, keyword 
searches work only for text data, yet many types of files commonly associated with emails, 
including attachments such as scanned documents, pictures, and videos, do not store data as 
searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture 
all relevant communications in an account, as it is impossible to know in advance all of the unique 
words or phrases that investigative subjects will use in their communications, and consequently 
there are often many communications in an account that are relevant to an investigation but that 
do not contain any keywords that an agent is likely to search for. 

37. Because Cohen anc are attorneys, the review of the content within the Subject 

Accounts will be conducted pursuant to established screening procedures to ensure that the law 
enforcement personnel involved in the investigation, including attorneys for the Government, 
collect evidence in a manner reasonably designed to protect any attorney-client or other applicable 
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privilege. When appropriate, the procedures will include use of a designated “filter team,” separate 
and apart from the investigative team, in order to review potentially privileged communications 
and determine which communications to release to the investigation and prosecution team. 

IV. Request for Non-Disclosure and Sealing Order 

38. The existence and scope of this ongoing criminal investigation are not publicly known. 
As a result, premature public disclosure of this affidavit or the requested warrants could alert 
Cohen that he is under investigation r xausing-himdQ-destrQy evidence,-flee from prosecutiQ.n,-or 


otherwise seriously jeopardize the investigation. In particular, based on my experience 
investigating white collar cases, including cases featuring documents such as agreements, drafts 
of agreements, notes of conversations, and other documentary evidence, premature disclosure of 
an investigation may cause the target of the investigation to attempt to destroy or conceal such 
evidence. In addition, as also set forth above, Cohen uses computers and electronic 
communications in furtherance of his activity and thus could easily delete, encrypt, or otherwise 
conceal such digital evidence from law enforcement were he to learn of the Government’s 
investigation. See 18 U.S.C. § 2705(b)(3). Cohen also appears to have the financial means that 
would facilitate his flight from prosecution. See 18 U.S.C. § 2705(b)(2), (5). 

39. Accordingly, there is reason to believe that, were the Providers to notify the subscriber 
or others of the existence of the warrant, the investigation would be seriously jeopardized. 
Pursuant to 18 U.S.C. § 2705 (b), I therefore respectfully request that the Court direct the Providers 
not to notify any person of the existence of the warrant for a period of 180 days from issuance, 
subject to extension upon application to the Court, if necessary. 

40. For similar reasons, I respectfully request that this affidavit and all papers submitted 
herewith be maintained under seal until the Court orders otherwise, except that the Government 
be permitted without further order of this Court to provide copies of the warrant and affidavit as 
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need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose 
those materials as necessary to comply with discovery and disclosure obligations in any 
prosecutions related to this matter. 

V. Conclusion 

41. Based on the foregoing, I respectfully request that the Court issue the warrants sought 
herein pursuant to the applicable provisions of the Stored Communications Act, 18 U.S.C. 
§2703(b)(1)(A)(forcontents)- a nd-§ ~2 703fc)fl-XAX ff o r- records-and-Other-informatio n), -andthe 
relevant provisions of Federal Rule of Criminal Procedure 41. 


Special Agent Mason Posilkin 
United States Attorney’s Office 
Southern District of New York 


Sworn to before me this 
28th day of February, 2018 


HONORABLE GABRIEL W. GORENSTEIN 
Chief United States Magistrate Judge 
Southern District of New York 
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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of a Warrant for All 
Content and Other Information 
Associated with the Email Accounts 
|5}gmail.com, 

11 

Maintained at 
Premises Controlled by Google, Inc., 
USAO Reference No. 2018R00127 



Search Warrant and Non-Disclosure Order 

TO: Google, Inc. (“Provider”) 

United States Attorney’s Office for the Southern District of New York and the Federal 
■ Bureau of Investigation (collectively, the “Investigative Agencies”) 

1. Warrant. Upon an affidavit of Special Ageni^^^^^^^^^Jof the United States 
Attorney’s Office for the Southern District of New York, and pursuant to the provisions of the 
Stored Communications Act, 18 U.S.C. § 2703(b)(1)(A) and § 2703(c)(1)(A), and the relevant 
provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable 
cause to believe the email accounts ^^^^^|@gmail.com 7lgmail.com, and 

I, maintained at premises controlled by Google, Inc., contain evidence, 
fruits, and instrumentalities of crime, all as specified in Attachments A and B hereto. Accordingly, 
the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date 
of service of this Warrant and Order, the records specified in Section II of Attachments A and B 
hereto, for subsequent review by law enforcement personnel as authorized in Sections III and IV 
of Attachments A and B. The Government is required to serve a copy of this Warrant and Order 
on the Provider within 7 days of the date of issuance. The Warrant and Order may be served via 
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electronic transmission or any other means through which the Provider is capable of accepting 
service. 


2. Non-Disclosure Order. Pursuant to 18 U.S.C. § 2705(b), the Court finds that there is 
reason to believe that notification of the existence of this warrant will result in destruction of or 
tampering with evidence or flight from prosecution, or otherwise will seriously jeopardize an 
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 
-existence of this Warrant and Grderto thedisted^subscriber orto anyiother person forraperiodof. 


180 days from the date of this Order, subject to extension upon application to the Court if 
necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider 
for the purpose of receiving legal advice. 

3. Sealing. It is further ordered that this Warrant and Order, and the Affidavit upon which 
it was issued, be filed under seal, except that the Government may without further order of this 
Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and 
Order as need be to personnel assisting the Government in the investigation and prosecution of 
this matter; and disclose these materials as necessary to comply with discovery and disclosure 
obligations in any prosecutions related to this matter. 

Dated: New York, New York 


Date Issued 


Time Issued 


HONORABLE GABRIEL W. GORENSTEIN 
Chief United States Magistrate Judge 
Southern District of New York 
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Email Search Attachment A 
I. Subject Account and Execution of Warrant 

This warrant is directed to Google, Inc. (the “Provider”), headquartered at 1600 
Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other 
information within the Provider’s possession, custody, or control associated with the email account 
@gmail.com (the “Subject Account”) for the time period referenced below. 

A law enforcem ent o fficer will s erve this war rant by transmitting it vi a email or another 


appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section III below. 

II. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Account: 

a. Email content. All emails sent to or from, stored in draft form in, or otherwise 
associated with the Subject Account, including all message content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email) 
limited to items sent, received, or created between November 14,2017 and the date of this warrant, 
inclusive. 


b. Address book information. All address book, contact list, or similar information 
associated with the Subject Account. 

c. Subscriber and payment information. All subscriber and payment information 
regarding the Subject Account, including but not limited to name, username, address, telephone 
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number, alternate email addresses, registration IP address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 

d. Transactional records. All transactional records associated with the Subject Account, 
including any IP logs or other records of session times and durations, limited to items sent, 
received, or created between December 1,2014 and the date of this warrant, inclusive. 

e. Customer correspondence. All correspondence with the subscriber or others associated 


with the Subject Account, including complaints, inquiries, or other contacts with support services 


and records of actions taken, limited to items sent, received, or created between December 1,2014 
and the date of this warrant, inclusive. 

f. Search History. All search history and/or web history associated with the Subject 
Account, limited to items sent, received, or created between December 1,2014 and the date of this 
warrant, inclusive. 

g. Associated content. All Google Docs, files maintained on Google Drive, and instant 
messages or Gchats associated with the Subject Account, limited to items sent, received, or created 
between December 1,2014 and the date of this warrant, inclusive. 

h. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703(f) or otherwise. 

ILL Review of Information by the Government 

Law enforcement personnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
and instrumentalities of violations of 18 U.S.C. §§ 371 (conspiracy to commit offense or to defraud 
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I 

I 

the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 

I 

(wire fraud), and 1344 (bank fraud), including the following: 

a. Communications, records, documents, and other files necessary to establish the identity 

1 

of the person(s) who created or used the Subject Account; 

i 

i 

b. Communications, records, documents, and other files involving Sterling National 
Bank, Melrose Credit Union, and/or taxi medallions; 

— gGmmunieationspreeordsf^OGumentS5=and=other=files4nvolving^a=plan^proposat or—-- 

agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to others, including t( and/or 

entities associated with him; 

d. Communications, records, documents, and other files involving Essential Consultants, 

LLC or Michael D. Cohen & Associates, including those which indicate the nature and purpose of 
payments made to or from Essential Consultants or Michael D. Cohen & Associates; 

e. Communications, records, documents, and other files necessary to establish the identity 

of any person(s) — including records that reveal the whereabouts of the person(s) — who 
communicated with the Subject Account about any matters relating to Essential Consultants, LLC, 
or about any plan or proposal or agreement for Michael D. Cohen and/or entities associated with 
him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, 
including t<| md/or entities associated with him; 

f. Communications between the Subject Account and Jeffrey Getzel relating to Michael 
D. Cohen’s bank accounts, taxes, debts, and/or finances; 

g. Communications, records, documents, and other files reflecting false representations 
to a financial institution with relation to the intended purpose of an account or loan at that financial 
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institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

h. Evidence indicating how and when the Subject Account was accessed or used, to 
determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; and 

= = r = ^i^-Evidence-indicating-the^Subjeet-Aeeount=owner=s--intent-aarit-relatesrtothe'Subjeet— 
Offenses under investigation. 

IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 
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Email Search Attachment B 

I. Subject Account and Execution of Warrant 

This warrant is directed to Google, Inc. (the “Provider”), headquartered at 1600 
Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other 
information within the Provider’s possession, custody, or control associated with the email 
account:^ @gmail.com and the “Subject Accounts”) for the time 

period -between Oc t ober-1 , -2 01 6 and thedatemf dhis -wa rra n t , in clus ive ... ._ 

A law enforcement officer will serve this warrant by transmitting it via email or another 
appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section III below. 

II. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Accounts: 

a. Email content. All emails sent to or from, stored in draft form in, or otherwise 
associated with the Subject Accounts, including all message content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email). 

b. Address book information. All address book, contact list, or similar information 
associated with the Subject Accounts. 

c. Subscriber and payment information. All subscriber and payment information 
regarding the Subject Accounts, including but not limited to name, username, address, telephone 
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t 

number, alternate email addresses, registration IP address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 

d. Transactional records. All transactional records associated with the Subject Accounts, 
including any IP logs or other records of session times and durations. 

e. Customer correspondence. All correspondence with the subscriber or others associated 
with the Subject Accounts, including complaints, inquiries, or other contacts with support services 

~ and records of r actions takenr- ----—---—----- —==-~4 

I 

f. Search History. All search history and/or web history associated with the Subject 
Accounts. 

g. Associated content. All Google Docs, files maintained on Google Drive, and instant 
messages or Gchats associated with the Subject Accounts. 

h. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703(f) or otherwise. 

III. Review of Information by the Government 

Law enforcement personnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
and instrumentalities of violations of 18 U.S.C. §§ 371 (conspiracy to commit offense or to defraud 
the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
(wire fraud), and 1344 (bank fraud), including the following: 

a. Communications, records, documents, and other files necessary to establish the identity 
of the person(s) who created or used the Subject Accounts; 
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b. Communications, records, documents, and other files involving a plan or proposal or 

agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, t< and/or entities associated 

with him; 

c. Communications, records, documents, and other files necessary to establish the identity 
of any person(s) - including records that reveal the whereabouts of the person(s) - who 


communicated witli the Subject Aecounts-about any matters relating to any plan or proposal or- 


agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, and/or entities associated 

with him; 


d. Communications between the Subject Accounts and others, including employees or 
representatives of Sterling National Bank, Melrose Credit Union, or other financial institution(s), 
regarding Michael D. Cohen’s finances; 

e. Communications, records, documents, and other files reflecting false representations 
to a financial institution with relation to the intended purpose of an account or loan at that financial 
institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

f. Evidence indicating how and when the Subject Accounts was accessed or used, to 
determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; 

g. Evidence indicating the Subject Accounts owners’ intent as it relates to the Subject 
Offenses under investigation. 
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IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 
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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of a Warrant for All 
Content and Other Information 
Assoc iated with the Email Account 
@aol.com, Maintained at 
Premises Controlled by Oath, Inc., 
US AO Reference No. 2018R00127 


Search Warrant and Non-Disclosure Order 


TO: Oath, Inc. (“Provider”) 

United States Attorney’s Office for the Southern District of New York and the Federal 

Bureau of Investigation (collectively, the “Investigative Agencies”) . 

1. Warrant. Upon an affidavit of Special Agent of the United States 

Attorney’s Office for the Southern District of New York, and pursuant to the provisions of the 
Stored Communications Act, 18 U.S.C. § 2703(b)(1)(A) and § 2703(c)(1)(A), and the relevant 
provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable 
cause to believe the email account @aol.com, maintained at premises controlled by Oath, 
Inc., contains evidence, fruits, and instrumentalities of crime, all as specified in Attachment C 
hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, 
within 7 days of the date of service of this Warrant and Order, the records specified in Section II 
of Attachment C hereto, for subsequent review by law enforcement personnel as authorized in 
Sections III and IV of Attachment C. The Government is required to serve a copy of this Warrant 
and Order on the Provider within 14 days of the date of issuance. The Warrant and Order may be 
served via electronic transmission or any other means through which the Provider is capable of 
accepting service. 
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2. Non-Disclosure Order. Pursuant to 18 U.S.C. § 2705(b), the Court finds that there is 
reason to believe that notification of the existence of this warrant will result in destruction of or 
tampering with evidence or flight from prosecution, or otherwise will seriously jeopardize an 
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 
existence of this Warrant and Order to the listed subscriber or to any other person for a period of 
180 days from the date of this Order, subject to extension upon application to the Court if 


necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider 


for the purpose of receiving legal advice. 

3. Sealing. It is further ordered that this Warrant and Order, and the Affidavit upon which 
it was issued, be filed under seal, except that the Government may without further order of this 
Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and 
Order as need be to personnel assisting the Government in the investigation and prosecution of 
this matter; and disclose these materials as necessary to comply with discovery and disclosure 
obligations in any prosecutions related to this matter. 

Dated: New York, New York 


Date Issued 


Time Issued 


HONORABLE GABRIEL W. GORENSTEIN 
Chief United States Magistrate Judge 
Southern District of New York 
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Email Search Attachment C 

I. Subject Account and Execution of Warrant 

This warrant is directed to Oath, Inc. (the “Provider”), headquartered at 22000 AOL Way, 
Dulles, Virginia 20166, and applies to all content and other information within the Provider’s 
possession, custody, or control associated with the email account @aol.com (the “Subject 
Account”) for the time period between December 1, 2016 and the date of this warrant, inclusive. 

-A-law-enforcement o ffic er-will-serve this-warrant-by-tran sm itting-^it- v i a -e m aiLor-another 

appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section III below. 

II. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Account: 

a. Email content. All emails sent to or from, stored in draft form in, or otherwise 
associated with the Subject Account, including all message' content, attachments, and header 
information (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email). 

b. Address book information. All address book, contact list, or similar information 
associated with the Subject Account. 

c. Subscriber and payment information. All subscriber and payment information 
regarding the Subject Account, including but not limited to name, username, address, telephone 
number, alternate email addresses, registration IP address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 
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d. Transactional records. All transactional records associated with the Subject Account, 
including any IP logs or other records of session times and durations. 

e. Customer correspondence. All correspondence with the subscriber or others associated 
with the Subject Account, including complaints, inquiries, or other contacts with support services 
and records of actions taken. 

f. Search History. All search history and/or web history. 


g. Preserverd or backup records? Any preserved or backup copies of any of the foregoing 


categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703(1) or otherwise. 

III. Review of Information by the Government 

Law enforcement personnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
and instrumentalities ofviolations of 18 U.S.C. §§ 371 (conspiracy to commit offense or to defraud 
the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
(wire fraud), and 1344 (bank fraud), including the following: 

a. Communications, records, documents, and other files necessary to establish the identity 
of the person(s) who created or used the Subject Account; 

b. Communications, records, documents, and other files involving a plan or proposal or 

agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to^^^^| md/or entities associated 

with him; 
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c. Communications, records, documents, and other files necessary to establish the identity 
of any person(s) - including records that reveal the whereabouts of the person(s) - who 
communicated with the Subject Account about any matters relating to any plan or proposal or 
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to and/or entities associated 

with him; 

-d“Communications~between' r the43ubjeetvAeeOunt“and T t)thers,-including^employees r or 
representatives of Sterling National Bank, Melrose Credit Union, or other financial institution(s), 
regarding Michael D. Cohen’s finances; and 

e. Communications, records, documents, and other files reflecting false representations 
to a financial institution with relation to the intended purpose of an account or loan at that financial 
institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution. 

IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 


02.28.2018 


3 















Case l:18-cr-00602-WHP Document 48-4 Filed 07/18/19 Page 97 of 105 


UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of a Warrant for All 
Content and Other Information 
Associ ated with the Email Account 
| ;.com, maintained at 
Premises Controlled by 1 & 1 Internet, 
Inc., USAO Reference No. 
2018R00127 


^ Search Warrant and Non-Disgeosijre Order 

TO: 1 & 1 Internet, Inc. (“Provider”) 

United States Attorney’s Office for the Southern District of New York and the Federal 
Bureau of Investigation (collectively, the “Investigative Agencies”) 

>f the United States 

Attorney’s Office for the Southern District of New York, and pursuant to the provisions of the 
Stored Communications Act, 18 U.S.C. § 2703(b)(1)(A) and § 2703(c)(1)(A), and the relevant 
provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable 

i, maintained at premises controlled by 1 
& 1 Internet, Inc., contains evidence, fruits, and instrumentalities of crime, all as specified in 
Attachment D hereto. Accordingly, the Provider is hereby directed to provide to the Investigative 
Agencies, within 7 days of the date of service of this Warrant and Order, the records specified in 
Section II of Attachment D hereto, for subsequent review by law enforcement personnel as 
authorized in Sections III and IV of Attachment D. The Government is required to serve a copy 
of this Warrant and Order on the Provider within 14 days of the date of issuance. The Warrant 
and Order may be served via electronic transmission or any other means through which the 
Provider is capable of accepting service. 


cause to believe the email account 


1. Warrant. Upon an affidavit of Special Agent 
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. 


2. Non-Disclosure Order. Pursuant to 18 U.S.C. § 2705(b), the Court finds that there is 
reason to believe that notification of the existence of this warrant will result in destruction of or 
tampering with evidence or flight from prosecution, or otherwise will seriously jeopardize an 
ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 
existence of this Warrant and Order to the listed subscriber or to any other person for a period of 
180 days from the date of this Order, subject to extension upon application to the Court if 

- - necessary, except that Provider may-.disclose this-Warrant and Order to an attorney for Provider 
for the purpose of receiving legal advice. 

3. Sealing. It is further ordered that this Warrant and Order, and the Affidavit upon which 
it was issued, be filed under seal, except that the Government may without further order of this 
Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and 
Order as need be to personnel assisting the Government in the investigation and prosecution of 
this matter; and disclose these materials as necessary to comply with discovery and disclosure 
obligations in any prosecutions related to this matter. 

Dated: New York, New York 


Date Issued 


Time Issued 


HONORABLE GABRIEL W. GORENSTEIN 
Chief United States Magistrate Judge 
Southern District of New York 
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Email Search Attachment D 

I. Subject Account and Execution of Warrant 

This warrant is directed to 1 & 1 Internet, Inc. (the “Provider”), headquartered at 701 Lee 
Road, Suite 300, Chesterbrook, Pennsylvania 19087, and applies to all content and other 
information within the Provider’s possession, custody, or control associated with the email account 
(the “Subject Account”) for the time period between November 14, 2017 
and-th e- da t c-of-this-warrant-inc l usi v e----- -— 

A law enforcement officer will serve this warrant by transmitting it via email or another 
appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
officer an electronic copy of the information specified in Section II below. Upon receipt of the 
production, law enforcement personnel will review the information for items falling within the 
categories specified in Section III below. 

II. Information to be Produced by the Provider 

To the extent within the Provider’s possession, custody, or control, the Provider is directed 
to produce the following information associated with the Subject Account: 

a. Email content. All emails sent to or from, stored in draft form in, or otherwise 
associated with the Subject Account, including all message content, attachments, and header 
infonnation (specifically including the source and destination addresses associated with each 
email, the date and time at which each email was sent, and the size and length of each email). 

b. Address book information. All address book,' contact list, or similar information 
associated with the Subject Account. 

c. Subscriber and payment information. All subscriber and payment information 
regarding the Subject Account, including but not limited to name, username, address, telephone 
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number, alternate email addresses, registration IP address, account creation date, account status, 
length of service, types of services utilized, means and source of payment, and payment history. 

d. Transactional records. All transactional records associated with the Subject Account, 
including any IP logs or other records of session times and durations. 

e. Customer correspondence. All correspondence with the subscriber or others associated 
with the Subject Account, including complaints, inquiries, or other contacts with support services 


and ~reeords~of actions‘taken ; -==----—-— : -—— 

f. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
categories of records, whether created in response to a preservation request issued pursuant to 18 
U.S.C. § 2703(f) or otherwise. 

III. Review of Information by the Government 

Law enforcement personnel (who may include, in addition to law enforcement officers and 
agents, attorneys for the government, attorney support staff, agency personnel assisting the 
government in this investigation, and outside technical experts under government control) are 
authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
and instrumentalities of violations of 18 U.S.C. §§371 (conspiracy to commit offense or to defraud 
the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
(wire fraud), and 1344 (bank fraud), including the following: 

a. Communications, records, documents, and other files necessary to establish the identity 
of the person(s) who created or used the Subject Account; 

b. Communications, records, documents, and other files involving Sterling National 
Bank, Melrose Credit Union, and/or taxi medallions; 

c. Communications, records, documents, and other files involving a plan, proposal, or 
agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
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and/or 


medallions, and any associated debts or liabilities, to others, including tc 
entities associated with him; 

d. Communications, records, documents, and other files involving Essential Consultants, 
LLC or Michael D. Cohen & Associates, including those which indicate the nature and purpose of 
payments made to or from Essential Consultants or Michael D. Cohen & Associates; 

e. The identity of any person(s) - including records that reveal the whereabouts of the 
person(s) — who-communicated r withThe Subject^tre"ounf : abouf any matters relating to“Essentiaf 


Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen and/or entities 
associated with him to transfer any interest in taxi medallions, and any associated debts or 
liabilities, to others, including t(^^^^^^^^^Jand/or entities associated with him; 

f. Communications between the Subject Account and Jeffrey Getzel relating to Michael 
D. Cohen’s bank accounts, taxes, debts, and/or finances; 

g. Communications, records, documents, and other files reflecting false representations 
to a financial institution with relation to the intended purpose of an account or loan at that financial 
institution; the nature of any business or entity associated with an account at a financial institution; 
the source of funds flowing into an account; or the purpose or nature of any financial transactions 
involving that financial institution; 

h. Evidence indicating how and when the Subject Account was accessed or used, to 
determine the geographic and chronological context of account access, use, and events relating to 
the crimes under investigation and to the account owner; and 

i. Evidence indicating the Subject Account owner’s intent as it relates to the Subject 
Offenses under investigation. 
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IV. Review Protocols 

Review of the items described in this Attachment shall be conducted pursuant to 
established procedures designed to collect evidence in a manner reasonably designed to protect 
any attorney-client or other applicable privilege. When appropriate, the procedures shall include 
use of a designated “filter team,” separate and apart from the investigative team, in order to address 
potential privileges. 
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f\ r% i f" i K \ A 

| j }-/ l [ -j j 1 \ { t4_ 

AO 93 (SDNY Rev. 05/10) Seardh'ani S^izure'WakJnt'^ 1 ' *“ 


United States District Court 

for the 

Southern District of New York 

In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

A Device Containing the Results of Three Email Search 
Warrants, See Attachment A 

SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the _ Southern District of _ New York 

(identify the person or describe the property to be searched and give its location)\ 

A Device Containing the Results of Three Email Search Warrants, See Attachment A 



The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized)'. 

See Attachment A 

I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 

* (nnt tn pxr.ppB 14 Bn 


property. 

YOU ARE COMMANDED to execute this warrant on or before 

' (not to exceed 14 days) 

□ in the daytime 6:00 a.m. to 10 p.m. Sf at any time in the day or night as I find reasonable cause has been 

established. 

Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. \y i , /, 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to the Clerk 0f the Court. 

</ Upon its return, this warrant and inventory should be filed under seal by the Clerk df the Court. 



;, ! q ■: U$m!pitidls 

Sf I find that immediate notification may have an adverse result listed in 18 U.S 1 C.y / 2705 (except fo;r delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who. of whose property, will be 
searched or seized (check the appropriate box) iTffor 30 days (not to exceed 30). ' ', ' U 7 * U 

t : / h iS * •• - • 

□until, the faptS)justifying, the latei^peci^c d'ate of 

Date and time issued: fiu zs, 

City and state: New York, NY _ _ Hon. Gabriel W. Gorenstein. U.S. Magistrate Judge 



Printed name and title 
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Attachment A 


I. Device to be Searched 

The device to be searched (the “Subject Device”) is described as a black and red USB drive 
with a white label that says “Tracking #: 180208140208”, which contains emails and other content 
information obtained pursuant to the three search warrants, numbered 17-mj-00503, 17-mj-00855 
and 17-mj-00854, obtained by the Special Counsel’s Office (“SCO”), less the emails that were 
screened and removed by the SCO’s privilege team. 

II. Review of ESI on the Subject Devices 

Law enforcement personnel (including, in addition to law enforcement officers and agents, 
and depending on the nature of the ESI and the status of the investigation and related proceedings, 
attorneys for the government, attorney support staff, agency personnel assisting the government in 
this investigation, interpreters, and outside vendors or technical experts under government control) 
are authorized to review the ESI contained on the Subject Device for evidence, fruits, and 
instrumentalities of one or more violations of 18 U.S.C. § 371 (conspiracy to defraud the United 
States), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (wire 
fraud), and 1344 (bank fraud) (collectively, the “Subject Offenses”), as listed below: 

a. Communications, records, documents, and other files involving Sterling National 
Bank, Melrose Credit Union, and/or taxi medallions; 


b. Communications, records, documents, and other files involving a plan, proposal, or 

agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
medallions, and any associated debts or liabilities, to others, including to and/or 

entities associated with him; 

c. The identity of any person(s) — including records that reveal the whereabouts of the 

person(s) — who communicated with fiigmail.com and/or | (the 

“Subject Accounts”) about any plan or proposal or agreement for Michael D. Cohen and/or entities 
associated with hi m to transfer any interest in taxi medallions, and any associated debts or 
liabilities, to others, including to and/or entities associated with him; 

d. Communications between the Subject Accounts and Jeffrey Getzel relating to 
Michael D. Cohen’s bank accounts, taxes, debts, and/or finances; 
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e. Evidence indicating the owner of the Subject Accounts’ intent as it relates to the 
Subject Offenses under investigation. 
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